All Apps and Add-ons

Splunk forwarder and splunk logs

templier
Communicator

Hello colleagues!
Use snort for splunk, when snort logs on the same server as splank, there are no problems with the processing of logs.
But if i use Splunk forwarder for transfer Snort log on the server, server not parses this logs by analogy with the data that it is physically located.

May be who can advise what configuration changes need to be made?

0 Karma
1 Solution

templier
Communicator

Сolleagues itself asked itself and has solved the problem.
A few words about the solution for windows:

After install splunk universal forwarder (continue - SUF) go to %setup folder%/etc/system/local/, (for example - D:\SplunkUniversalForwarder\etc\system\local)


After, create or modify two files:


inputs.conf must contain:

[monitor://C:\Snort\log]
disabled = false
sourcetype = snort_alert_full

monitor://C:\Snort\log - your way to the folder with snort logs.


outputs.conf must contain:

server = ip:port 
[tcpout-server://ip:port]

IP:Port - ip address you splunk server, port is specified at the web interface server -Settings->Forwarding and receiving->Configure receiving->New

View solution in original post

0 Karma

templier
Communicator

Сolleagues itself asked itself and has solved the problem.
A few words about the solution for windows:

After install splunk universal forwarder (continue - SUF) go to %setup folder%/etc/system/local/, (for example - D:\SplunkUniversalForwarder\etc\system\local)


After, create or modify two files:


inputs.conf must contain:

[monitor://C:\Snort\log]
disabled = false
sourcetype = snort_alert_full

monitor://C:\Snort\log - your way to the folder with snort logs.


outputs.conf must contain:

server = ip:port 
[tcpout-server://ip:port]

IP:Port - ip address you splunk server, port is specified at the web interface server -Settings->Forwarding and receiving->Configure receiving->New

0 Karma