All Apps and Add-ons

What is the best way to pass Snort logs into the Splunk for Snort app?

w0lverineNOP
Path Finder

What is the best way to pass Snort logs into the Splunk for Snort App? Should I use a mount or a forwarder? Or any other suggestions?

Tags (2)
0 Karma
1 Solution

Jeremiah
Motivator

The Snort app doesn't include any input configs, so its really up to you. How are you collecting other log data in your environment? In general, using forwarders is the best option. Do make sure to use the sourcetypes that are defined for you in the props.conf file, so you can take advantage of the included extractions.

View solution in original post

Jeremiah
Motivator

The Snort app doesn't include any input configs, so its really up to you. How are you collecting other log data in your environment? In general, using forwarders is the best option. Do make sure to use the sourcetypes that are defined for you in the props.conf file, so you can take advantage of the included extractions.

w0lverineNOP
Path Finder

Universal Forwarders! That was going to be my answer. I had some friends tell me use mount but it didn't make sense. Thanks!

0 Karma

ppablo
Retired

Hi @w0lverineNOP

Glad you got an answer to your question 🙂 please don't forget to resolve your posts by clicking "Accept" directly below the answer. This will make it easier for other users with the same/similar questions find the solution too. Thanks!

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...