OK, the main problem I see with your setup is that you have set the sourcetype "snort". As the installation docs for Splunk for Snort state, you need to set either snort_alert_fast for alert_fast format or snort_alert_full for alert_full format. This is because these two need to be parsed differently in order to achieve correct event breaking, and I suspect this is what is causing you problems - events are not breaking properly so event boundaries in Splunk will not correspond to event boundaries in the original log file. ... View more