Getting Data In
Highlighted

Bro 2.6.4 forward to splunk

New Member

I am not the best with setup so i am looking for an all in one step by step for getting bro logs into splunk. I previously had the logs forwarded but the fields were not showing up. Here is my setup thus far:
Bro 2.6.4 on Ubuntu server 18.04 LTS (fresh Install based on https://wpcademy.com/how-to-install-bro-network-security-monitor-on-ubuntu-16-04-lts/ minus the geoIP stuff)
Splunk Enterprise 8.0.1 (fresh install based on https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/InstallonLinux)
started and created admin
configured to start on boot
I just see so many bits and pieces of what to do next to get Bro logs into Splunk i find myself doing the trial and error thing.
Thank you for any help (i know this can't be that difficult)

0 Karma
Highlighted

Re: Bro 2.6.4 forward to splunk

SplunkTrust
SplunkTrust

@tazzvon

Have you tried Splunk Add-on for Zeek aka Bro?

The Splunk Add-on for Zeek aka Bro supports two log formats: TSV and JSON. JSON format is support for Zeek aka Bro versions 2.3.x, 2.4.x, and 2.5.x. Not sure about 2.6.x but you can try if there are no change logs.

Splunkbase link: https://splunkbase.splunk.com/app/1617/ ?
Documentation: https://docs.splunk.com/Documentation/AddOns/released/BroIDS/Description

You can find bro configuration in below link.
https://docs.splunk.com/Documentation/AddOns/released/BroIDS/Configuration#Configure_Bro_log_monitor...

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.