How to forward pcap files from a Linux universal forwarder to Splunk on a Windows machine with the PCAP Analyzer for Splunk app?

[billcyz]

I have Snort IDS running on aLinux machine, and I have some pcap files from Snort. I have installed a Universal Forwarder on Linux, and I want to forward the pcap files to Splunk which is on a Windows machine. I also downloaded the Splunk application for PCAP which is called Splunk PCAP Analyzer, but I don't know how to forward pcap files to the application on Splunk.

Can anyone help me with that? Any help would be great.

Thank You

[woodcock]

Wherever the pcap files end up, you need to install a Splunk forwarder there. Then you need to create an inputs.conf stanza to monitor for the incoming pcap files. Assuming all the files will appear in the same directory, it is very easy and you can read about it here:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Monitorfilesanddirectories
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Editinputs.conf

[billcyz]

I have insatlled Universal Forwarder on my Linux machine, but I am confused about the source type. On the other hand, I also want to use Splunk PCAP Analyzer, however not so many resources available. Could you please give me some advice?

[woodcock]

Look inside the files that the app installs and see what sourcetype it expects/uses. Then use that same name for your sourcetype. I have not used that app but it should have a README file that will get you started.