All Apps and Add-ons

What is the best way to pass Snort logs into the Splunk for Snort app?

w0lverineNOP
Path Finder

What is the best way to pass Snort logs into the Splunk for Snort App? Should I use a mount or a forwarder? Or any other suggestions?

Tags (2)
0 Karma
1 Solution

Jeremiah
Motivator

The Snort app doesn't include any input configs, so its really up to you. How are you collecting other log data in your environment? In general, using forwarders is the best option. Do make sure to use the sourcetypes that are defined for you in the props.conf file, so you can take advantage of the included extractions.

View solution in original post

Jeremiah
Motivator

The Snort app doesn't include any input configs, so its really up to you. How are you collecting other log data in your environment? In general, using forwarders is the best option. Do make sure to use the sourcetypes that are defined for you in the props.conf file, so you can take advantage of the included extractions.

View solution in original post

w0lverineNOP
Path Finder

Universal Forwarders! That was going to be my answer. I had some friends tell me use mount but it didn't make sense. Thanks!

0 Karma

ppablo
Community Manager
Community Manager

Hi @w0lverineNOP

Glad you got an answer to your question 🙂 please don't forget to resolve your posts by clicking "Accept" directly below the answer. This will make it easier for other users with the same/similar questions find the solution too. Thanks!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!