[Bro] problem ingesting bro json logs into splunk

[Brandon Lattin]

Drew,

It should work just fine, assuming TSV headers are present, as it keys off
the headers for the extractions.

On Thu, Jul 14, 2016 at 11:14 AM, Drew Dixon <dwdixon at umich.edu> wrote:

> Sorry hope I'm not hijacking- quick question very closely related to
> this...is the Splunk app for Bro that Brandon linked to here supposed to
> parse out all the various bro 2.4.1 log types' fields correctly?
> In other words, is the latest version of the Splunk app fro Bro/TA
> supposed to work properly for parsing out Bro log fields with they way the
> log fields/columns etc. are now in Bro 2.4.1? I think the Splunk Add-on for
> Bro IDS was written for Bro 2.1 or 2.2...do changes that were made in
> subsequent versions of Bro such as 2.4.1 break the fields being parsed out
> in Splunk when using this Splunk Add-on for Bro/Bro TA in Splunkbase?  Or
> does Splunk need to update the add-on to work properly with Bro 2.4.1?
>
> Thank you,
>
> -Drew
>
> On Thu, Jul 14, 2016 at 11:59 AM, Azoff, Justin S <jazoff at illinois.edu>
> wrote:
>
>>
>> > On Jul 14, 2016, at 11:33 AM, Gross, Brett <gross.b at ghc.org> wrote:
>> >
>> > We’ve used bro and splunk at our organization for a couple years now.
>> We utilize the Splunk props and transforms configs to ingest the bro log in
>> the format we want or with the additional attributes and aliases.
>>
>> Ah, that's for the tab delimited logs, not the json logs though.  I
>> actually did it that way for years, I even have a python program that helps
>> you generate the config:
>>
>>
>> https://github.com/JustinAzoff/bro_scripts/blob/2.0/generate_splunk_configs.py
>>
>> But, I wouldn't use this method - the splunk TA app for bro is better.
>>
>> As far as I know the transforms/props method only does the field lookups
>> at search time, not at index time like the TA app configures.
>>
>> Whenever the bro logs change and a column is added or removed, all those
>> search time field lookups break.
>>
>>
>> --
>> - Justin Azoff
>>
>>
>>
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>>
>
>
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>



-- 
Brandon Lattin
Security Analyst
University of Minnesota - University Information Security
Office: 612-626-6672
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160714/3068c362/attachment.html