How to send Cowrie output to Splunk

Splunk Output Module

• In Splunk, enable the HTTP Event Collector (go to Settings->Add Data)

• Do not enable Indexer Acknowledgment

• Copy the authorization token for later use

• Modify cowrie.cfg to enable the [output_splunk] section

• Configure the URL for HTTP Event Collector and add the authorization token you copied in the previous step

• Optionally enable sourcetype, source, host and index settings

File Based

• Collect var/log/cowrie/cowrie.json output file using Splunk

Reporting

Please see: https://github.com/aplura/Tango