Splunk Enterprise

TA-Suricata issue - Data not properly parsed

b_chris21
Path Finder

Hello,

i have a search head (deployment server) with ES and a distributed environment with suricata eve.json monitoring from the remote indexers. I would like to bring CIM compatible data in ES.

TA-suricata is installed using the deployment server to all clients. Suricata data are properly transformed. Checked data in remote indexer and are properly CIM parsed.

Installed TA-suricata in search head, but with the same search, I don't see the same data output. What shall I configure on inputs.conf?

I have in both SH and Indexers the following inputs.conf configuration:

[monitor]:///var/log/suricata/eve.json
disabled = false
index = suricata
sourcetype = suricata
source = /var/log/suricata/eve.json


Any help would be appreciated.

Thank you in advance,

Chris

Labels (1)
Tags (2)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!