It depends on your container OS. For RHEL/CentOS: http://linuxsysconfig.com/2013/04/how-to-configure-remote-logging-on-rhel6-centos6/ For Ubuntu: http://www.randomhacks.co.uk/how-to-configure-an-ubuntu-server-to-log-to-a-remote-syslog-server/ Windows Clients: Event Log forwarding is your best bet and put the universal forwarder on the Collector System https://msdn.microsoft.com/en-us/library/cc748890(v=ws.11).aspx https://splunkbase.splunk.com/app/1680/ ... View more

Please see revised answer at the bottom reflecting response converted to answer. ... View more

Best practice would be to install a forwarder on each container, yes. Simply add the log folder to the monitor on the forwarder or configure a deployment server to deliver the appropriate app. Please see the following links for command line implementations of forwarder deployments: Configuring the forwarders: http://docs.splunk.com/Documentation/Forwarder/6.6.0/Forwarder/Configuretheuniversalforwarder Setting the deployment server: https://docs.splunk.com/Documentation/Splunk/6.6.0/Updating/Configuredeploymentclients Configure and set up deployment server: http://docs.splunk.com/Documentation/Splunk/6.6.0/Updating/Createdeploymentapps Hope this helps ... View more

You need to escape special characters like slash and period. Please reference the following link for special character list. http://regular-expressions.mobi/characters.html?wlr=1 Hope that helps. ... View more

By the way if you didn't already know, Splunk has a pip package available command built just for inspecting an apps prior release or install. Please see the page on Splunk Docs for AppInspect. It also has command line examples that I used for my app when submitting. http://dev.splunk.com/view/appinspect/SP-CAAAFAM It covers cloud deployments and on-premises instances. ... View more

I have gone through and started working on this problem personally. Best bet is to implement the TA-Bro, Snort and Suricata apps if all you need is splunk event ingest. Splunk 6.6 provides the ability now to build drilldown dashboards without XML markup much like the security Onion Dashboards are built. In lieu of waiting for the author to make the necessary changes, you could modify the props.conf, transforms.conf and inputs.conf to suit your particular instance of security onion. Make sure that the fields referenced in the transforms.conf match your BroIDS version. THose fields have a habit of changing per build of BroIDS. Also if you want to get snort alerts you may forward the alerts to local syslog facility and bring them into Splunk that way. This is only a temporary fix in the event the author does not update for a while. Please feel free to contact me and I can provide the transforms I am using with a Security Onion 14.04.5.2 build. ... View more

Works PERFECTLY! Thanks a lot. To avoid being inundated with pids field I simply modified this search to: index=process | table pid ppid hostname | eventstats values(pid) as pids by hostname | where isnull(mvfind(pids,ppid)) | fields - pids ... View more

This answer is also functional but eventstats permits avoidance of subsearch. For small data sets this is a more efficient solution. I will have to be aware of overreaching my subsearch limit. If i had more points, I would award them here. ... View more