Getting Data In

snare Sourcetype

New Member

Hi all,

i'm running splunk 4.2.1 i need to take windows log by snare agent. When i create a data input and select souce type i can't see windows_snare_syslog choice.

help me plz

Tags (3)
0 Karma

New Member

the support solution go well

In SplunkWeb

  1. Click on the "Apps" pulldown and select "Manage Apps..."
  2. You should find an App named Legacy
  3. Enable it - yours is probably disabled

You should have a props.conf file in SPLUNK_HOME/etc/apps/legacy/default/

You should find a stanza that looks like this...

pulldown_type = true

Make sure pulldown_type is set to true

0 Karma


If the sourcetype you want doesn't appear in the dropdown list, you can select "Manual" under "Set sourcetype", and then type in windows_snare_syslog directly.

0 Karma