All Apps and Add-ons

Bro Splunk Integration

New Member

Who has successfully gotten Bro logs to integrate with Splunk? Right now, I have forwarded logs from IP and UDP port 514, this is causing a problem because it thinks all the data is coming from there. In reality, that is just where I have Bro running. It is getting data from elsewhere.

0 Karma

Re: Bro Splunk Integration


We use the Splunk universal forwarder to read the log files that we want to have in our Bro index.