Getting Data In

Bro 2.6.4 forward to splunk

tazzvon
Engager

I am not the best with setup so i am looking for an all in one step by step for getting bro logs into splunk. I previously had the logs forwarded but the fields were not showing up. Here is my setup thus far:
Bro 2.6.4 on Ubuntu server 18.04 LTS (fresh Install based on https://wpcademy.com/how-to-install-bro-network-security-monitor-on-ubuntu-16-04-lts/ minus the geoIP stuff)
Splunk Enterprise 8.0.1 (fresh install based on https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/InstallonLinux)
started and created admin
configured to start on boot
I just see so many bits and pieces of what to do next to get Bro logs into Splunk i find myself doing the trial and error thing.
Thank you for any help (i know this can't be that difficult)

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@tazzvon

Have you tried Splunk Add-on for Zeek aka Bro?

The Splunk Add-on for Zeek aka Bro supports two log formats: TSV and JSON. JSON format is support for Zeek aka Bro versions 2.3.x, 2.4.x, and 2.5.x. Not sure about 2.6.x but you can try if there are no change logs.

Splunkbase link: https://splunkbase.splunk.com/app/1617/ ?
Documentation: https://docs.splunk.com/Documentation/AddOns/released/BroIDS/Description

You can find bro configuration in below link.
https://docs.splunk.com/Documentation/AddOns/released/BroIDS/Configuration#Configure_Bro_log_monitor...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...