All Apps and Add-ons

Why is the Splunk Add-on for Bro IDS not automatically extracting the fields?

Path Finder

example bro_notice fields go ts (tab) uid (tab) id.orig_h (tab) etc etc splunk is like ignoring these????? Do I need to manually recreate all the fields????

Path Finder

I have a similar issue. I have a search head and separate indexer; there is a universal forwarder sending the Bro log files to the indexer (I'm not bothering with the PCAP stuff for now).

Logs are being ingested ok, and my input for the deployment app looks like:

disabled = 0
sourcetype = bro
index = bro
whitelist = \.log$

The sourcetype is appearing ok but the field extractions aren't working. Am I missing an install/config step?

0 Karma

Path Finder

For others' info, universal forwarders are not supported for Bro, you have to run a heavy forwarder with the Bro app installed. Once you have that then the fields extraction works as intended.

0 Karma

Splunk Employee
Splunk Employee

It is supposed to parse the fields, and it continues to do so in our automated tests and demo environments. I don't know what you're doing differently. You could file a ticket, since it's a supported app, or follow the troubleshooting tips at

0 Karma


I have exactly the same issue with bro running on linux with a universal forwarder (6.4.0) sending data to an indexer running Splunk Enterprise (also 6.4.0) and the latest bro addon(3.2.0).

Is there a fix planned?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...