Splunk Enterprise

TA-Suricata issue - Data not properly parsed

b_chris21
Path Finder

Hello,

i have a search head (deployment server) with ES and a distributed environment with suricata eve.json monitoring from the remote indexers. I would like to bring CIM compatible data in ES.

TA-suricata is installed using the deployment server to all clients. Suricata data are properly transformed. Checked data in remote indexer and are properly CIM parsed.

Installed TA-suricata in search head, but with the same search, I don't see the same data output. What shall I configure on inputs.conf?

I have in both SH and Indexers the following inputs.conf configuration:

[monitor]:///var/log/suricata/eve.json
disabled = false
index = suricata
sourcetype = suricata
source = /var/log/suricata/eve.json


Any help would be appreciated.

Thank you in advance,

Chris

Labels (1)
Tags (2)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!