# Bro +Splunk

**URL:** <https://community.zeek.org/t/bro-splunk/3892>\
**Category:** Zeek\
**Created:** [November 5, 2015, 12:52pm UTC](https://community.zeek.org/t/bro-splunk/3892 "2015-11-05T12:52:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Monah\_Baki](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Monah\_Baki](https://community.zeek.org/u/Monah_Baki)\
**Post date:** [November 5, 2015, 12:52pm UTC](https://community.zeek.org/t/bro-splunk/3892/1 "2015-11-05T12:52:04Z")

</div>

Hi all,

Any good documentation for newbies as to how to send bro logs to a  
remote splunk server?  
What's the requirements on both sides and what files needs to be  
touched on the bro to send the logs to the remote splunk server.  
I know I installed from the splunk app the "Splunk add on for bro ids"

Thanks  
Monah

---

<div class="post-metadata">

**Author:** ![Patrick\_Kelley1](https://avatars.discourse-cdn.com/v4/letter/p/aeb1de/32.png) [@Patrick\_Kelley1](https://community.zeek.org/u/Patrick_Kelley1)\
**Post date:** [November 5, 2015, 3:18pm UTC](https://community.zeek.org/t/bro-splunk/3892/2 "2015-11-05T15:18:36Z")

</div>

Yes! Use the Splunk Universal Forwarder and monitor the “/usr/local/bro/logs/current” folder. Make sure you configure Splunk to receive the data. This can be done under settings.

**Instructions**

Install the forwarder -

[http://www.splunk.com/en\_us/download/universal-forwarder.html](http://www.splunk.com/en_us/download/universal-forwarder.html)

Add the location of your Splunk server -  
./splunk add forward-server [172.0.0.20:9997](http://172.0.0.20:9997)

Add the monitor command -  
./splunk add monitor //usr/local/bro/logs/current

That’s it.

![image001.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/edcd7fecc87c1a3c4c493627cdf4951cb57911f7.png)

 ![Screen Shot 2015-11-05 at 7.18.03 AM.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/30807655e32330a47d0f89b5bc5ec5cabdcb75f6.png)

---

<div class="post-metadata">

**Author:** ![Brandon\_Lattin1](https://avatars.discourse-cdn.com/v4/letter/b/a587f6/32.png) [@Brandon\_Lattin1](https://community.zeek.org/u/Brandon_Lattin1)\
**Post date:** [November 5, 2015, 3:21pm UTC](https://community.zeek.org/t/bro-splunk/3892/3 "2015-11-05T15:21:10Z")

</div>

Splunk universal forwarders monitoring the files you’re interested (those in the ./current directory) on the Bro cluster master.

The Splunk TA for Bro on the search head(s), indexer(s), and on the Bro cluster master ([https://splunkbase.splunk.com/app/1617/](https://splunkbase.splunk.com/app/1617/)). I highly suggest forking it and removing the Splunk\_TA\_Bro/default/inputs.conf and building your own.

That should get you started.

---

<div class="post-metadata">

**Author:** ![Monah\_Baki](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Monah\_Baki](https://community.zeek.org/u/Monah_Baki)\
**Post date:** [November 5, 2015, 3:31pm UTC](https://community.zeek.org/t/bro-splunk/3892/4 "2015-11-05T15:31:24Z")

</div>

Hi Patrick,

[http://www.splunk.com/en\_us/download/universal-forwarder.html](http://www.splunk.com/en_us/download/universal-forwarder.html) Can’t foind a link to download the universal forwarder. Is it free?

Thanks

Monah

![image001.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/edcd7fecc87c1a3c4c493627cdf4951cb57911f7.png)

---

<div class="post-metadata">

**Author:** ![Patrick\_Kelley1](https://avatars.discourse-cdn.com/v4/letter/p/aeb1de/32.png) [@Patrick\_Kelley1](https://community.zeek.org/u/Patrick_Kelley1)\
**Post date:** [November 5, 2015, 3:33pm UTC](https://community.zeek.org/t/bro-splunk/3892/5 "2015-11-05T15:33:19Z")

</div>

Yes, it is. Just register for a Splunk account, which is free.

[https://www.splunk.com/page/sign\_up?redirecturl=http://www.splunk.com/en\_us/download/universal-forwarder.html](https://www.splunk.com/page/sign_up?redirecturl=http://www.splunk.com/en_us/download/universal-forwarder.html)

Once you register using the link above, it should send you to the free download.

![image001.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/edcd7fecc87c1a3c4c493627cdf4951cb57911f7.png)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/bro-splunk/3892/6 "2022-05-06T15:43:11Z")

</div>

Closed on May 6, 2022, 3:43pm UTC