Getting Data In

snare Sourcetype

zagor
New Member

Hi all,

i'm running splunk 4.2.1 i need to take windows log by snare agent. When i create a data input and select souce type i can't see windows_snare_syslog choice.

help me plz

Tags (3)
0 Karma

zagor
New Member

the support solution go well

In SplunkWeb

  1. Click on the "Apps" pulldown and select "Manage Apps..."
  2. You should find an App named Legacy
  3. Enable it - yours is probably disabled

You should have a props.conf file in SPLUNK_HOME/etc/apps/legacy/default/

You should find a stanza that looks like this...

[windows_snare_syslog]
pulldown_type = true

Make sure pulldown_type is set to true

0 Karma

southeringtonp
Motivator

If the sourcetype you want doesn't appear in the dropdown list, you can select "Manual" under "Set sourcetype", and then type in windows_snare_syslog directly.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...