Hi,
I currently have a ossec server running on my linux server with Splunk Forwarder installed on it as well. I have also downloaded the add-on and app for OSSEC in my Splunk indexer.
**I have configured the ossec.conf file in my ossec server to:**
$ipaddress 9521 default
**And the Forwarder inputs.conf file:**
[default]
host = $hostname
[monitor:///var/ossec/logs/alerts/alerts*]
disabled = 0
index = myindex
sourcetype = ossec_alerts
[monitor:///var/ossec/logs/ossec.log]
disabled = 0
index = myindex
sourcetype = ossec_log
[monitor:///var/ossec/logs/active-responses.log]
disabled = 0
index = myindex
sourcetype = ossec_ar
How should i proceed the next step to get the data to my Splunk?
Any help will be appreciated, thanks!
↧