topic Re: A wrong configuration script (configure.sh) in Splunk Add-on for NetFlow Ver 3.0.1. in All Apps and Add-ons

A wrong configuration script (configure.sh) in Splunk Add-on for NetFlow Ver 3.0.1.

sunrise — Mon, 24 Aug 2015 04:58:02 GMT

This post is not a question, but an enhancement request for Splunk Add-on for NetFlow Ver 3.0.1.
I installed Splunk Enterprise 6.2.5 and Splunk Add-on for NetFlow Ver 3.0.1 on a Linux server and configured it by "configure.sh" in this add-on.

Though I've done this almost default settings and transferred netflow packets to this UDP receiving port, I could not get any netflow packets in Splunk.

Re: A wrong configuration script (configure.sh) in Splunk Add-on for NetFlow Ver 3.0.1.

sunrise — Tue, 29 Sep 2020 07:03:56 GMT

In some tests, I got a solution to this issue.
I found that "configure.sh" may be wrong.

Original "configure.sh" in this App (Ver 3.0.1) includes following lines.
let keepDays=$keepDays-1
if [[ -z "$keepDays" ]]; then
keepDays="2"
fi

This causes wrong days to keep ascii flow logs in flowfix.sh which is executed by script stanza in inputs.conf.
find /opt/splunk625/etc/apps/Splunk_TA_flowfix/nfdump-ascii -type f -mtime +-1 -exec rm -f {} \;

So if you encounter this issue, you need to change flowfix.sh manually, or specify custom days during its configurations.

Re: A wrong configuration script (configure.sh) in Splunk Add-on for NetFlow Ver 3.0.1.

thejohn — Sun, 24 Jan 2016 22:44:38 GMT

the script has major errors which results in a broken flowfix.sh file.

Re: A wrong configuration script (configure.sh) in Splunk Add-on for NetFlow Ver 3.0.1.

huns0004 — Sun, 04 Sep 2016 14:27:32 GMT

I have also found this bug. Enter the days manually or change the script to do the null comparison first.

Disappointing that this has been out there for over a year and hasn't been fixed yet.