Why is the Splunk Add-on for Bro IDS not automatically extracting the fields?

[cdupuis123]

example bro_notice fields go ts (tab) uid (tab) id.orig_h (tab) etc etc splunk is like ignoring these????? Do I need to manually recreate all the fields????

[alexlomas]

I have a similar issue. I have a search head and separate indexer; there is a universal forwarder sending the Bro log files to the indexer (I'm not bothering with the PCAP stuff for now).

Logs are being ingested ok, and my input for the deployment app looks like:

[monitor:///usr/local/bro/logs/current]
disabled = 0
sourcetype = bro
index = bro
whitelist = \.log$

The sourcetype is appearing ok but the field extractions aren't working. Am I missing an install/config step?

[alexlomas]

For others' info, universal forwarders are not supported for Bro, you have to run a heavy forwarder with the Bro app installed. Once you have that then the fields extraction works as intended.

[jcoates_splunk]

It is supposed to parse the fields, and it continues to do so in our automated tests and demo environments. I don't know what you're doing differently. You could file a ticket, since it's a supported app, or follow the troubleshooting tips at http://docs.splunk.com/Documentation/AddOns/released/Overview/Troubleshootadd-ons

[reesb]

I have exactly the same issue with bro running on linux with a universal forwarder (6.4.0) sending data to an indexer running Splunk Enterprise (also 6.4.0) and the latest bro addon(3.2.0).

Is there a fix planned?