Getting Data In

Event logs from Snare not organized like Windows Universal Forwarder does?

johns3
Path Finder

I have been using the Snare agent to send my Windows Event logs to syslog-ng then off to Splunk with the Linux Universal forwarder. Everything is working great but the event logs that show up in Splunk are not organized how the regular Windows Universal forwarder sends them. With the setup I have now the entire event log is all squished together, with the Windows universal forwarder it puts everything on its own line in a very organized and easy to read fashion. I also noticed that the universal forwarder gets rid of the paragraph long informational junk that is with certain event logs.

Is there anyway to fix this? I assume this is more of a Snare issue but other people must have had this problem before.

Tags (1)
0 Karma

Ayn
Legend

No, this is how Snare formats its logs. It cannot use newlines in its messages because that would violate the syslog standard. I've found no way of reliably finding points in these messages where you can exchange certain whitespace characters for newlines.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...