Splunk Add-on for Netflow

edwardrose — Mon, 15 Jun 2015 21:08:53 GMT

Hello All,

I have installed Splunk App for NetFlow and ran the configure.sh script. But the flowfix.sh script seems to be a little off.
#!/bin/bash

# Listener command for nfcapd 1 - v5 - -b IPV4 - 9955
if [ ! -f /opt/splunk/etc/apps/Splunk_TA_flowfix/bin/nfcapd-1-v5--b/opt/splunk/etc/apps/Splunk_TA_flowfix/bin/Linux_x86_64_core2/nfcapd -p 9955 -bfi

# Listener command for nfcapd 2 - v9 - -b IPv4 - 9939
if [ ! -f /opt/splunk/etc/apps/Splunk_TA_flowfix/bin/nfcapd-2-v9--b/opt/splunk/etc/apps/Splunk_TA_flowfix/bin/Linux_x86_64_core2/nfcapd -p 9939 -bfi

# Listener command for nfcapd 3 - v9 - -b IPv4 - 9949
if [ ! -f /opt/splunk/etc/apps/Splunk_TA_flowfix/bin/nfcapd-3-v9--b/opt/splunk/etc/apps/Splunk_TA_flowfix/bin/Linux_x86_64_core2/nfcapd -p 9949 -bfi

# Listener command for nfcapd 4 - IPFIX - -b IPv4 - 9910
if [ ! -f /opt/splunk/etc/apps/Splunk_TA_flowfix/bin/nfcapd-4-IPFIX--b/opt/splunk/etc/apps/Splunk_TA_flowfix/bin/Linux_x86_64_core2/nfcapd -p 9910 -bfi

# This part converts the binary flows to csv/ascii
if [[ `find /opt/splunk/etc/apps/Splunk_TA_flowfix/nfdump-binary/* | grep nfcapd.2` ]]; then

FILES=`ls /opt/splunk/etc/apps/Splunk_TA_flowfix/nfdump-binary/*/nfcapd.2*`

for FILE in ${FILES[*]}
do
/opt/splunk/etc/apps/Splunk_TA_flowfix/bin/Linux_x86_64_core2/nfdump -qr "$FILE" -o csv >> /opt/splunk/etc/apps/Splunk_TA_flowfix/nfdump-ascii/nfdump-csv_`date +"%Y%m%d%H%M%S"`.log && rm "$FILE"
done;
fi

# Cleanup files older than -1
find /opt/splunk/etc/apps/Splunk_TA_flowfix/nfdump-ascii -type f -mtime +-1 -exec rm -f {} \;

The Listener lines seem to be incomplete and when the script runs all I get is unexpected end of file. To me it looks like all he if statements in the listeners are incomplete. Is this a bug that the configure script did not setup properly?

[root@splk-gns-fwd-01 bin]# ./flowfix.sh
./flowfix.sh: line 28: syntax error: unexpected end of file
[root@splk-gns-fwd-01 bin]#

Any help is appreciated.

Thanks
ed

Re: Splunk Add-on for Netflow

jcoates_splunk — Mon, 15 Jun 2015 21:28:41 GMT

what shell does your Linux use? Just verified that this works fine on bash in CentOS 6.4.

Re: Splunk Add-on for Netflow

edwardrose — Mon, 15 Jun 2015 22:54:24 GMT

CentOs 6.5 bash

Re: Splunk Add-on for Netflow

jcoates_splunk — Sun, 12 Jul 2015 02:04:23 GMT

Probably worth a support ticket so we can diagnose properly; that seems like a shell problem, but bash is what we test with and there've been no other complaints against this heavily used Add-on.

Re: Splunk Add-on for Netflow

edwardrose — Tue, 14 Jul 2015 17:51:43 GMT

Splunk ticket was created and it appears that the script is sort of unclear when it asks IPv4, IPv6 or all. I guess you are suppose to enter an IP address or leave blank for all. Once I left the answer blank for all the script completed correctly. I was mistakenly entering IPv4 instead of an actual IP address

topic Splunk Add-on for Netflow in All Apps and Add-ons

Splunk Add-on for Netflow

Re: Splunk Add-on for Netflow

Re: Splunk Add-on for Netflow

Re: Splunk Add-on for Netflow

Re: Splunk Add-on for Netflow