sourcetype broken

[ShaunBaker]

So with lots of trail and error, I've found that why both the Splunk for Snort and Snort for Splunk apps are not working because when I give the data input a sourcetype of "snort", splunk simply does not ingest the data coming in from barnyard2 via snort via pfSense. If I change sourcetype to "syslog", then I see events rolling into the index- if I search that index it is valid snort logs (albeit not field extracted because of being the wrong sourcetype).

What could be "braking" the sourcetype ingestion?

[fugglefeet · Accepted solution]

Hi ShaunBaker,

Is your question about Splunk for Snort or about Snort for Splunk? The Splunk for Snort app is developed by another author while I developed Snort for Splunk. Have you read the included README files of both apps to see how the apps are configured to work in the various environments?

fugglefeet

[ShaunBaker]

It was in regards to either, as both are set to use that sourcetype. Strangely it started working, I suppose a reboot should have been done instead of a debug/refresh? Maybe it was my pfSense/Barnyard2 having some kind of lag.