What is the best way to pass Snort logs into the Splunk for Snort app?

[w0lverineNOP]

What is the best way to pass Snort logs into the Splunk for Snort App? Should I use a mount or a forwarder? Or any other suggestions?

[Jeremiah · Accepted solution]

The Snort app doesn't include any input configs, so its really up to you. How are you collecting other log data in your environment? In general, using forwarders is the best option. Do make sure to use the sourcetypes that are defined for you in the props.conf file, so you can take advantage of the included extractions.

[w0lverineNOP]

Universal Forwarders! That was going to be my answer. I had some friends tell me use mount but it didn't make sense. Thanks!

[ppablo]

Hi @w0lverineNOP

Glad you got an answer to your question 🙂 please don't forget to resolve your posts by clicking "Accept" directly below the answer. This will make it easier for other users with the same/similar questions find the solution too. Thanks!