topic Re: snare Sourcetype in Getting Data In

snare Sourcetype

zagor — Mon, 28 Sep 2020 09:31:16 GMT

Hi all,

i'm running splunk 4.2.1 i need to take windows log by snare agent. When i create a data input and select souce type i can't see windows_snare_syslog choice.

help me plz

Re: snare Sourcetype

southeringtonp — Tue, 03 May 2011 16:03:35 GMT

If the sourcetype you want doesn't appear in the dropdown list, you can select "Manual" under "Set sourcetype", and then type in windows_snare_syslog directly.

Re: snare Sourcetype

zagor — Mon, 28 Sep 2020 09:31:37 GMT

the support solution go well

In SplunkWeb

Click on the "Apps" pulldown and select "Manage Apps..."
You should find an App named Legacy
Enable it - yours is probably disabled

You should have a props.conf file in SPLUNK_HOME/etc/apps/legacy/default/

You should find a stanza that looks like this...

[windows_snare_syslog]
pulldown_type = true

Make sure pulldown_type is set to true