I have pfsense dumping syslog to my splunk server. I'm not sure why but my snort app within splunk does not show any data. A search on my internal default gateway reveals a lot of information. Not sure how to search on it to help me out.
Splunk for Snort expects full alert logs to have a sourcetype of "snort_alert_full" and fast alert logs to have a sourcetype of "snort_alert_fast". Note that you don't need both types, any one will do - these distinctions are only there to make sure that Splunk parses the logs correctly. Sourcetypes are renamed to "snort" at search time, so if you do have both full and fast logs you won't need to worry about searching separately for each corresponding sourcetype.
I have the same issue. PFSense and Snort all in the same pfsense index. Im assuming I have to install the forwarder on my pfsense box to forward those logs, and not dump the snort logs into syslog.