Bro 2.6.4 forward to splunk

[tazzvon]

I am not the best with setup so i am looking for an all in one step by step for getting bro logs into splunk. I previously had the logs forwarded but the fields were not showing up. Here is my setup thus far:
Bro 2.6.4 on Ubuntu server 18.04 LTS (fresh Install based on https://wpcademy.com/how-to-install-bro-network-security-monitor-on-ubuntu-16-04-lts/ minus the geoIP stuff)
Splunk Enterprise 8.0.1 (fresh install based on https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/InstallonLinux)
started and created admin
configured to start on boot
I just see so many bits and pieces of what to do next to get Bro logs into Splunk i find myself doing the trial and error thing.
Thank you for any help (i know this can't be that difficult)

[kamlesh_vaghela]

@tazzvon

Have you tried Splunk Add-on for Zeek aka Bro?

The Splunk Add-on for Zeek aka Bro supports two log formats: TSV and JSON. JSON format is support for Zeek aka Bro versions 2.3.x, 2.4.x, and 2.5.x. Not sure about 2.6.x but you can try if there are no change logs.

Splunkbase link: https://splunkbase.splunk.com/app/1617/ ?
Documentation: https://docs.splunk.com/Documentation/AddOns/released/BroIDS/Description

You can find bro configuration in below link.
https://docs.splunk.com/Documentation/AddOns/released/BroIDS/Configuration#Configure_Bro_log_monitor...