All Apps and Add-ons

Splunk and Pfsense

grantfarms
New Member

I have pfsense dumping syslog to my splunk server. I'm not sure why but my snort app within splunk does not show any data. A search on my internal default gateway reveals a lot of information. Not sure how to search on it to help me out.

Tags (1)
0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Splunk for Snort expects full alert logs to have a sourcetype of "snort_alert_full" and fast alert logs to have a sourcetype of "snort_alert_fast". Note that you don't need both types, any one will do - these distinctions are only there to make sure that Splunk parses the logs correctly. Sourcetypes are renamed to "snort" at search time, so if you do have both full and fast logs you won't need to worry about searching separately for each corresponding sourcetype.

gimmemoredata
New Member

I have the same issue. PFSense and Snort all in the same pfsense index. Im assuming I have to install the forwarder on my pfsense box to forward those logs, and not dump the snort logs into syslog.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...