Archive
Highlighted

How to install Snort for Splunk

New Member

I have Snort forwarding syslog to my Splunk server. I can see the Snort alerts show up in Splunk.

How do I get the "Splunk for Snort" app to show this data? I have installed the app and can pull it up, but it's empty...

According to install instructions:
"You will need to enable the appropriate inputs, either via inputs.conf, or through the Manager in the Splunk GUI."

I'm not sure how to go about doing this. I already have a port 514 UDP input(which is how Snort alerts are getting to Splunk.) I can't add another.

Thanks
Ron

Tags (1)
0 Karma
Highlighted

Re: How to install Snort for Splunk

Legend

What sourcetype do your Snort events have?

0 Karma
Highlighted

Re: How to install Snort for Splunk

New Member

The sourcetype is syslog.

0 Karma
Highlighted

Re: How to install Snort for Splunk

Legend

Then you need to resolve that. As the documentation for the app says, the sourcetype needs to be "snortalertfast" for the "fast" log format, and "snortalertfull" for the full log format.

0 Karma
Highlighted

Re: How to install Snort for Splunk

New Member

Forgive me for my newbness on this topic but I don't understand how to change the sourcetype.

It appears that I do that in the Splunk Data Preview app. How? Create a new Event Type?

0 Karma
Highlighted

Re: How to install Snort for Splunk

Legend

You'd need to rewrite the sourcetype based on something that uniquely identifies the logs as Snort logs, like that they come from a certain host, contain something unique to Snort, etc. sourcetype rewriting is totally doable but I imagine can cause some confusion if you're new to Splunk. Here's an answer that can get you going: http://splunk-base.splunk.com/answers/34251/udp514-and-source-types

Also this: http://docs.splunk.com/Documentation/Splunk/5.0/Data/Advancedsourcetypeoverrides