I'm using Splunk Enterprise 8.0.4.1. I'm looking to upload Snort logs (version 2.9.16) manually (via Settings -- Add Data).
I see there is a Source Type under Network & Security for Snort. However, I can't tell which Snort output type it expects.
I tried the following output formats, but none were interpreted correctly:
- alert_fast
- alert_full
- alert_csv
- unified2
Note: I am not using the Snort for Splunk nor the Splunk for Snort apps. I am attempting to use the built-in source type.
