All Apps and Add-ons

How to forward pcap files from a Linux universal forwarder to Splunk on a Windows machine with the PCAP Analyzer for Splunk app?

billcyz
Engager

I have Snort IDS running on aLinux machine, and I have some pcap files from Snort. I have installed a Universal Forwarder on Linux, and I want to forward the pcap files to Splunk which is on a Windows machine. I also downloaded the Splunk application for PCAP which is called Splunk PCAP Analyzer, but I don't know how to forward pcap files to the application on Splunk.

Can anyone help me with that? Any help would be great.

Thank You

0 Karma

woodcock
Esteemed Legend

Wherever the pcap files end up, you need to install a Splunk forwarder there. Then you need to create an inputs.conf stanza to monitor for the incoming pcap files. Assuming all the files will appear in the same directory, it is very easy and you can read about it here:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Monitorfilesanddirectories
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Editinputs.conf

billcyz
Engager

I have insatlled Universal Forwarder on my Linux machine, but I am confused about the source type. On the other hand, I also want to use Splunk PCAP Analyzer, however not so many resources available. Could you please give me some advice?

0 Karma

woodcock
Esteemed Legend

Look inside the files that the app installs and see what sourcetype it expects/uses. Then use that same name for your sourcetype. I have not used that app but it should have a README file that will get you started.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.