All Apps and Add-ons

Snort output format expected for built-in Snort source type


I'm using Splunk Enterprise I'm looking to upload Snort logs (version 2.9.16) manually (via Settings -- Add Data).

I see there is a Source Type under Network & Security for Snort. However, I can't tell which Snort output type it expects.

I tried the following output formats, but none were interpreted correctly:

  • alert_fast
  • alert_full
  • alert_csv
  • unified2

Note: I am not using the Snort for Splunk nor the Splunk for Snort apps. I am attempting to use the built-in source type.

Labels (1)
Tags (1)
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!