Configuring Splunk with a Snare/ Windows Security ...

rmcdougal · ‎11-30-2012

Ok, so for reasons beyond this discussion we are unable to use the universal forwarder. So, we have decided to bring in our data using Snare. Has anyone had any experience with creating a sourcetype for snare forwarded messages?

sdaniels · ‎11-30-2012

There is pretrained sourcetype for this already. Last one in the table. Just make sure to set your sourcetype manually to 'windows_snare_syslog'.

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Listofpretrainedsourcetypes

Configuring Splunk with a Snare/ Windows Security Log Sourcetype

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Are you a member of the Splunk Community?

Configuring Splunk with a Snare/ Windows Security Log Sourcetype

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever