snare Sourcetype

[zagor]

Hi all,

i'm running splunk 4.2.1 i need to take windows log by snare agent. When i create a data input and select souce type i can't see windows_snare_syslog choice.

help me plz

[zagor]

the support solution go well

In SplunkWeb

1. Click on the "Apps" pulldown and select "Manage Apps..."
2. You should find an App named Legacy
3. Enable it - yours is probably disabled

You should have a props.conf file in SPLUNK_HOME/etc/apps/legacy/default/

You should find a stanza that looks like this...

[windows_snare_syslog]
pulldown_type = true

Make sure pulldown_type is set to true

[southeringtonp]

If the sourcetype you want doesn't appear in the dropdown list, you can select "Manual" under "Set sourcetype", and then type in windows_snare_syslog directly.