All Apps and Add-ons

What is the best way to pass Snort logs into the Splunk for Snort app?

w0lverineNOP
Path Finder

What is the best way to pass Snort logs into the Splunk for Snort App? Should I use a mount or a forwarder? Or any other suggestions?

Tags (2)
0 Karma
1 Solution

Jeremiah
Motivator

The Snort app doesn't include any input configs, so its really up to you. How are you collecting other log data in your environment? In general, using forwarders is the best option. Do make sure to use the sourcetypes that are defined for you in the props.conf file, so you can take advantage of the included extractions.

View solution in original post

Jeremiah
Motivator

The Snort app doesn't include any input configs, so its really up to you. How are you collecting other log data in your environment? In general, using forwarders is the best option. Do make sure to use the sourcetypes that are defined for you in the props.conf file, so you can take advantage of the included extractions.

w0lverineNOP
Path Finder

Universal Forwarders! That was going to be my answer. I had some friends tell me use mount but it didn't make sense. Thanks!

0 Karma

ppablo
Retired

Hi @w0lverineNOP

Glad you got an answer to your question 🙂 please don't forget to resolve your posts by clicking "Accept" directly below the answer. This will make it easier for other users with the same/similar questions find the solution too. Thanks!

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...