TA's without Universal Forwarder

[willadams]

Wondering if anyone is able to provide some information / feedback around a requirement I have. We due to various reasons are not using SPLUNK forwarders to send data to SPLUNK. We use an agent called SNARE that sends logs that then collects in an Index. In previous trials we found that there were TA's available for things like Powershell, Sysmon that SPLUNK would index appropriately and we could search on those indexes explicitly. The SNARE agent we are using doesn't do that and writes to 1 agent.

Would it be possible to change the way our agent logs to SPLUNK by changing the format type to "SYSLOG" from "SNARE" to the same index's used and utilise the SPLUNK TA's (and associated indexers) to capture the information?

[richgalloway]

If you can elaborate on why you are not running Splunk forwarder perhaps we can help you overcome whatever resistance to them there is.

Changing your sourcetype from SNARE to syslog may help, but it's probably best to customize the SNARE sourcetype to be compatible with your data.

I get the impression you want to use a Splunk TA on a system this is running SNARE, but is not running Splunk. TAs normally do not run independent of Splunk.

Have you considered Splunk's HTTP Event Collector (HEC)? You could configure HEC on Splunk then have your agent send events to it in JSON format via HTTP.

[willadams]

I have contemplated possibly taking my existing index and then extracting the information in the same format as the TA would be doing. A bit more work but possible?