Getting Data In

Bro 2.6.4 forward to splunk

tazzvon
Engager

I am not the best with setup so i am looking for an all in one step by step for getting bro logs into splunk. I previously had the logs forwarded but the fields were not showing up. Here is my setup thus far:
Bro 2.6.4 on Ubuntu server 18.04 LTS (fresh Install based on https://wpcademy.com/how-to-install-bro-network-security-monitor-on-ubuntu-16-04-lts/ minus the geoIP stuff)
Splunk Enterprise 8.0.1 (fresh install based on https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/InstallonLinux)
started and created admin
configured to start on boot
I just see so many bits and pieces of what to do next to get Bro logs into Splunk i find myself doing the trial and error thing.
Thank you for any help (i know this can't be that difficult)

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@tazzvon

Have you tried Splunk Add-on for Zeek aka Bro?

The Splunk Add-on for Zeek aka Bro supports two log formats: TSV and JSON. JSON format is support for Zeek aka Bro versions 2.3.x, 2.4.x, and 2.5.x. Not sure about 2.6.x but you can try if there are no change logs.

Splunkbase link: https://splunkbase.splunk.com/app/1617/ ?
Documentation: https://docs.splunk.com/Documentation/AddOns/released/BroIDS/Description

You can find bro configuration in below link.
https://docs.splunk.com/Documentation/AddOns/released/BroIDS/Configuration#Configure_Bro_log_monitor...

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...