Bro Splunk Integration

[bachube]

Who has successfully gotten Bro logs to integrate with Splunk? Right now, I have forwarded logs from IP 10.85.250.200 and UDP port 514, this is causing a problem because it thinks all the data is coming from there. In reality, that is just where I have Bro running. It is getting data from elsewhere.

[jgedeon120]

We use the Splunk universal forwarder to read the log files that we want to have in our Bro index.