All Apps and Add-ons

Why is the Splunk Add-on for Bro IDS not automatically extracting the fields?

cdupuis123
Path Finder

example bro_notice fields go ts (tab) uid (tab) id.orig_h (tab) etc etc splunk is like ignoring these????? Do I need to manually recreate all the fields????

alexlomas
Path Finder

I have a similar issue. I have a search head and separate indexer; there is a universal forwarder sending the Bro log files to the indexer (I'm not bothering with the PCAP stuff for now).

Logs are being ingested ok, and my input for the deployment app looks like:

[monitor:///usr/local/bro/logs/current]
disabled = 0
sourcetype = bro
index = bro
whitelist = \.log$

The sourcetype is appearing ok but the field extractions aren't working. Am I missing an install/config step?

0 Karma

alexlomas
Path Finder

For others' info, universal forwarders are not supported for Bro, you have to run a heavy forwarder with the Bro app installed. Once you have that then the fields extraction works as intended.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

It is supposed to parse the fields, and it continues to do so in our automated tests and demo environments. I don't know what you're doing differently. You could file a ticket, since it's a supported app, or follow the troubleshooting tips at http://docs.splunk.com/Documentation/AddOns/released/Overview/Troubleshootadd-ons

0 Karma

reesb
Engager

I have exactly the same issue with bro running on linux with a universal forwarder (6.4.0) sending data to an indexer running Splunk Enterprise (also 6.4.0) and the latest bro addon(3.2.0).

Is there a fix planned?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...