Splunk forwarder and splunk logs

[templier]

Hello colleagues!
Use snort for splunk, when snort logs on the same server as splank, there are no problems with the processing of logs.
But if i use Splunk forwarder for transfer Snort log on the server, server not parses this logs by analogy with the data that it is physically located.

May be who can advise what configuration changes need to be made?

[templier · Accepted solution]

Сolleagues itself asked itself and has solved the problem.
A few words about the solution for windows:

After install splunk universal forwarder (continue - SUF) go to %setup folder%/etc/system/local/, (for example - D:\SplunkUniversalForwarder\etc\system\local)

---

After, create or modify two files:

---

inputs.conf must contain:

[monitor://C:\Snort\log]
disabled = false
sourcetype = snort_alert_full

monitor://C:\Snort\log - your way to the folder with snort logs.

---

outputs.conf must contain:

server = ip:port 
[tcpout-server://ip:port]

IP:Port - ip address you splunk server, port is specified at the web interface server -Settings->Forwarding and receiving->Configure receiving->New