https://community.splunk.com/t5/Getting-Data-In/How-to-send-Windows-Event-Logs-in-Snare-over-Syslog-format/m-p/584136#M102847 <P>I'm researching a solution for sending Windows Event logs to a third party service that requires them to be in "Snare over Syslog" format, not the&nbsp;RFC-3164-compliant format that Splunk puts them in when using syslog format.</P> <P>Has anyone accomplished this? We do have a heavy forwarder in our environment that is set up to receive these logs from our Universal Forwarders, and I know you can use things like SEDCMD to modify data within the logs as they come in, but I haven't found a way to completely reformat them into this new format and send them out.&nbsp;</P> <P>If anyone has done this or has any tips, I'd appreciate it!</P> <P>This is what the format looks like:</P> <P><A href="https://prophecyinternational.atlassian.net/wiki/spaces/SCWXWA/pages/89144134/Appendix+A+-+Event+Output+Format" target="_blank" rel="noopener">Appendix A - Event Output Format - Snare SCWX Windows Agent v5 Documentation - Confluence (atlassian.net)</A></P> Thu, 10 Feb 2022 22:23:51 GMT eblackburn 2022-02-10T22:23:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-Windows-Event-Logs-in-Snare-over-Syslog-format/m-p/584136#M102847 <P>I'm researching a solution for sending Windows Event logs to a third party service that requires them to be in "Snare over Syslog" format, not the&nbsp;RFC-3164-compliant format that Splunk puts them in when using syslog format.</P> <P>Has anyone accomplished this? We do have a heavy forwarder in our environment that is set up to receive these logs from our Universal Forwarders, and I know you can use things like SEDCMD to modify data within the logs as they come in, but I haven't found a way to completely reformat them into this new format and send them out.&nbsp;</P> <P>If anyone has done this or has any tips, I'd appreciate it!</P> <P>This is what the format looks like:</P> <P><A href="https://prophecyinternational.atlassian.net/wiki/spaces/SCWXWA/pages/89144134/Appendix+A+-+Event+Output+Format" target="_blank" rel="noopener">Appendix A - Event Output Format - Snare SCWX Windows Agent v5 Documentation - Confluence (atlassian.net)</A></P> Thu, 10 Feb 2022 22:23:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-Windows-Event-Logs-in-Snare-over-Syslog-format/m-p/584136#M102847 eblackburn 2022-02-10T22:23:51Z