About Zaphod

Zaphod · ‎09-16-2020

This is not my experience. index=* sourcetype=Xmlwineventlog | stats count by sourcetype returns stats for sourcetype XmlWinEventLog index=* sourcetype=xmlwineventlog | stats count by sourcetype returns stats for sourcetype XmlWinEventLog and sourcetype xmlwineventlog.

Zaphod · ‎07-09-2020

I'm using Splunk Enterprise 8.0.4.1. I'm looking to upload Snort logs (version 2.9.16) manually (via Settings -- Add Data). I see there is a Source Type under Network & Security for Snort. However, I can't tell which Snort output type it expects. I tried the following output formats, but none were interpreted correctly: alert_fast alert_full alert_csv unified2 Note: I am not using the Snort for Splunk nor the Splunk for Snort apps. I am attempting to use the built-in source type.

Posts	2
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎07-09-2020

Online Status	Offline
Date Last Visited	‎09-16-2020 06:14 PM

Snort output format expected for built-in Snort so...

Re: are sourcetype names case-sensitive?

Snort output format expected for built-in Snort so...