- In Splunk, enable the HTTP Event Collector (go to Settings->Add Data)
- Do not enable
Indexer Acknowledgment - Copy the authorization token for later use
- Modify
cowrie.cfgto enable[splunk]section - Add URL to HTTP Event Collector and add the authorization token
- Optionally enable sourcetype, source, host and index settings
- Collect cowrie.json output file using Splunk
Please see: https://github.com/aplura/Tango