[ OSSEC + Splunk ] config/install

On Splunk:

Example install Splunk:

rpm -Uvh splunk-5.0.2-149561-linux-2.6-x86_64.rpm

Install ossec module into splunk

nano /opt/splunk/etc/system/default/inputs.conf

[udp://192.168.10.109:10002] # OSSEC server IP
disabled = false
sourcetype = ossec

OR