# Analyzing and Visualizing Bro Logs with Splunk **URL:** \ **Category:** Zeek\ **Created:** [April 19, 2012, 3:13pm UTC](https://community.zeek.org/t/analyzing-and-visualizing-bro-logs-with-splunk/2296 "2012-04-19T15:13:20Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Chris\_Crawford](https://avatars.discourse-cdn.com/v4/letter/c/13edae/32.png) [@Chris\_Crawford](https://community.zeek.org/u/Chris_Crawford)\ **Post date:** [April 19, 2012, 3:13pm UTC](https://community.zeek.org/t/analyzing-and-visualizing-bro-logs-with-splunk/2296/1 "2012-04-19T15:13:20Z")
Does anybody have the slides or video from "Analyzing and Visualizing Bro Logs with Splunk" talk at Bro Workshop 2011? -Chris ---
**Author:** ![Azoff\_Justin](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Azoff\_Justin](https://community.zeek.org/u/Azoff_Justin)\ **Post date:** [April 19, 2012, 3:37pm UTC](https://community.zeek.org/t/analyzing-and-visualizing-bro-logs-with-splunk/2296/2 "2012-04-19T15:37:10Z")
Hmm, I thought they were put on the website.. I was difficult and used the google HTML5 slideshow template 🙂 The presentation is attached. Let me know if you have any questions. The old metrics scripts I mention were indeed obsoleted by 2.0, but I've updated most of them: > **[GitHub - JustinAzoff/bro\_scripts: Analysis scripts for the Bro Intrusion...](https://github.com/JustinAzoff/bro_scripts/tree/2.0/)** > > 2.0/ [splunk.tgz](https://community.zeek.org/uploads/short-url/dFTJKAJPds8MqT17V600pKTpxOh.tgz) (866 KB) ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 19, 2012, 4:36pm UTC](https://community.zeek.org/t/analyzing-and-visualizing-bro-logs-with-splunk/2296/3 "2012-04-19T16:36:41Z")
It used live data and wasn't recorded. Justin, do you have anything shareable? There was also the Security Onion app for Splunk that was recently released. Since quite a bit of it revolves around Bro data you could try working with that if you are interested in using Bro data in Splunk.   .Seth ---
**Author:** ![Brad\_Shoop](https://avatars.discourse-cdn.com/v4/letter/b/ba9def/32.png) [@Brad\_Shoop](https://community.zeek.org/u/Brad_Shoop)\ **Post date:** [May 4, 2012, 3:23pm UTC](https://community.zeek.org/t/analyzing-and-visualizing-bro-logs-with-splunk/2296/4 "2012-05-04T15:23:09Z")
Justin Azoff \ albany.edu\> writes: > \> Does anybody have the slides or video from "Analyzing and Visualizing > \> Bro Logs with Splunk" talk at Bro Workshop 2011? > \> > \> -Chris > > Hmm, I thought they were put on the website.. I was difficult and used > the google HTML5 slideshow template > > The presentation is attached. Let me know if you have any questions. > > The old metrics scripts I mention were indeed obsoleted by 2.0, but I've > updated most of them: > > [GitHub - JustinAzoff/bro\_scripts: Analysis scripts for the Bro Intrusion Detection System](https://github.com/JustinAzoff/bro_scripts/tree/2.0/) If you want to get going quickly, download the Security Onion app for Splunk and either install it (if it's not a Security Onion system, you'll want to disable the SOstat scripts) or rename it to a .tar.gz and extract. If you're already pulling Bro data in, you should be able to match up the sourcetype names to the props/transforms.conf then copy the props.conf and transforms.conf files to your Splunk instance. That will get you all the field extractions and data into Splunk, and the Security Onion app will provide some initial dashboards and panels to give you more ideas. Brad Shoop ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/analyzing-and-visualizing-bro-logs-with-splunk/2296/5 "2022-05-06T15:40:19Z")