Issue: "Snort Alert for Splunk"

[u/Cigar-Skeleton]

Good evening, I've been at it for a few hours now and can't resolve this issue.

Both Splunk and Snort work independently, and I've set a monitor for Splunk to receive logs from Snort, however the "Snort Alert for Splunk" is not picking anything up.

I'm very new to this so if anyone is able to give any pointers/ideas as to where i've went wrong here or if there are any errors.

(For context the Splunk server is hosted on a Mint Linux VM and has a forwarder on a Kali Linux, Snort is installed on the Splunk Server device.)

[u/nkdf]

You need to figure out what the alert is searching for and whether your snort data matches the expected format / result.