All Apps and Add-ons

Snort output format expected for built-in Snort source type

Zaphod
Engager

I'm using Splunk Enterprise 8.0.4.1. I'm looking to upload Snort logs (version 2.9.16) manually (via Settings -- Add Data).

I see there is a Source Type under Network & Security for Snort. However, I can't tell which Snort output type it expects.

I tried the following output formats, but none were interpreted correctly:

  • alert_fast
  • alert_full
  • alert_csv
  • unified2

Note: I am not using the Snort for Splunk nor the Splunk for Snort apps. I am attempting to use the built-in source type.

Labels (1)
Tags (1)
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.