All Apps and Add-ons

Using Snare and Splunk App for Windows

rmcdougal
Path Finder

We are planning on using Snare to collect our desktop event logs. The problem is I haven't found a good way to integrate the Snare log format into the Splunk App for Windows. Has anyone tackled this task in the past?

http://splunk-base.splunk.com/apps/22315/

0 Karma

peterbarzen
New Member

You can send from Snare in generic syslog format.

0 Karma

treinke
Builder

Why not just use the Splunk for Windows in a light forwarder mode? This would allow you to send all the logs/data to Splunk without have the web interface on the host. Is there concerns about using the Splunk agent?

There are no answer without questions
0 Karma

treinke
Builder

Got any examples of the logs it is sending to Splunk?

There are no answer without questions
0 Karma

rmcdougal
Path Finder

The problem is that we have already deployed the Snare agent to our environment.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...