topic Re: SPLUNK for SNORT not working in All Apps and Add-ons

SPLUNK for SNORT not working

thunbolt22 — Mon, 28 Sep 2020 14:16:16 GMT

I am trying to get SPLUNK for SNORT up and running with no luck. I am new to SNORT,SPLUNK, and linux in gerneral. But here is what i have.
CentOS running SNORT and producing an ALERT and log file
Windows PC running SPLUNK

I setup the universal forwarder and all my SNORT alerts appear in SPLUNK as sourcetype snort_alert_full using the following command:
/opt/splunkforwarder/bin/splunk add monitor /etc/log/snort/ -index main -sourcetype snort_alert_full

When viewing in Splunk for snort i have no results. my understanding is that when the data is processed it should be renames from snort_alert_full to snort, i dont see this happeneing. And cannot search for src_ip as it is not being indexed properly.

Is there something i have to do to get Splunk for snort to process the data and index it properly?

Re: SPLUNK for SNORT not working

starcher — Sat, 06 Jul 2013 12:54:25 GMT

Try changing snort to alert fast. Then same for the file monitor for the splunk forwarder

Re: SPLUNK for SNORT not working

thunbolt22 — Mon, 08 Jul 2013 13:23:35 GMT

I ended up reinstalling Splunk for Snort and everything worked.

Re: SPLUNK for SNORT not working

praveen_recker — Sun, 06 Oct 2013 03:55:47 GMT

http://www.disects.com/whitepapers/Logging_Snort_alerts_to_Syslog_and_Splunk.pdf