All Apps and Add-ons
Highlighted

Bro Splunk Integration

New Member

Who has successfully gotten Bro logs to integrate with Splunk? Right now, I have forwarded logs from IP 10.85.250.200 and UDP port 514, this is causing a problem because it thinks all the data is coming from there. In reality, that is just where I have Bro running. It is getting data from elsewhere.

0 Karma
Highlighted

Re: Bro Splunk Integration

Contributor

We use the Splunk universal forwarder to read the log files that we want to have in our Bro index.