Getting Data In

Event logs from Snare not organized like Windows Universal Forwarder does?

johns3
Path Finder

I have been using the Snare agent to send my Windows Event logs to syslog-ng then off to Splunk with the Linux Universal forwarder. Everything is working great but the event logs that show up in Splunk are not organized how the regular Windows Universal forwarder sends them. With the setup I have now the entire event log is all squished together, with the Windows universal forwarder it puts everything on its own line in a very organized and easy to read fashion. I also noticed that the universal forwarder gets rid of the paragraph long informational junk that is with certain event logs.

Is there anyway to fix this? I assume this is more of a Snare issue but other people must have had this problem before.

Tags (1)
0 Karma

Ayn
Legend

No, this is how Snare formats its logs. It cannot use newlines in its messages because that would violate the syslog standard. I've found no way of reliably finding points in these messages where you can exchange certain whitespace characters for newlines.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...