Suricata does't send json to splunk

, ,
1

Hi,
Suricata does’t send logs to splunk in json file format and sends it in syslog format
can anybody help to to solve the problem?

thanks,

2

What version of Suricata are you using?

Please share your suricata config file (suricata.yaml)

3

version: 6.0.10
suricata.yaml (73.0 KB)

4

First, Suricata 6.0.10 is EOL and is not supported.

The suricata configuration file shows that eve.json is being created and will contain logs and alerts from suricata.

Suricata isn’t involved in log export; it creates and populates the files as it processes packets.

5

Hi, I have the same issue, and I want to get Suricata logs into Splunk, but the logs are not being parsed. Has anyone experienced a similar problem?

6

Probably a better question to Splunk support. Suricata generates Suricata logs, but isn’t involved in the process of getting those into Splunk, that would be done by Splunk tooling.