https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270434#M31368 <P>Hello,</P> <P>You could also try the Scrutinizer add on for Splunk: <A href="https://www.plixer.com/splunk-integration.html">https://www.plixer.com/splunk-integration.html</A> which includes extensive support for Palo Alto: <A href="https://www.plixer.com/palo-alto-networks-integration.html">https://www.plixer.com/palo-alto-networks-integration.html</A>.</P> <P>Now you have a couple choices. </P> <P>Hope this helps. </P> Tue, 25 Oct 2016 06:56:20 GMT jakemichaelwils 2016-10-25T06:56:20Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270428#M31362 <P>Hi,<BR /> I have installed Netflow Analytics for Splunk and Splunk Add-on for Netflow.<BR /> The problem is that Netflow is not displaying the data is captured. But when I type sourcetype="netflow", I don't have any result. Didn't find the file "nfdump.log". I configured the Palo Alto Networks Firewall to send Netflow data by port 9996. Also, for Splunk, the input data is configured using UDP:</P> <UL> <LI>514 for pan:log </LI> <LI>9996 for netflow</LI> <LI>10514 flowintegrator</LI> </UL> <P>Is there any configuration to do?<BR /> Please Help me </P> <P>Best regards</P> Mon, 24 Oct 2016 13:22:34 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270428#M31362 Nesrinepfe 2016-10-24T13:22:34Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270429#M31363 <P>Hi,</P> <P>how does your input.conf stanzas look like?</P> <P>Have you defined the sourcetype in the input stanza?</P> Mon, 24 Oct 2016 14:21:33 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270429#M31363 TStrauch 2016-10-24T14:21:33Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270430#M31364 <P>Hi,Thank you very much for your response.I am new user for splunk Netflow can you please explain to me what is input stanza? How can I configure ? </P> Mon, 24 Oct 2016 14:28:35 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270430#M31364 Nesrinepfe 2016-10-24T14:28:35Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270431#M31365 <P>Hi, yes its a little much to explain everything here <span class="lia-unicode-emoji" title=":winking_face:">😉</span> But simply have a look at the documentation. Its pretty straight forward.</P> <P><A href="http://docs.splunk.com/Documentation/AddOns/released/NetFlow/Configureinputs">http://docs.splunk.com/Documentation/AddOns/released/NetFlow/Configureinputs</A></P> <P>There you will find everything you need to know to configure the add-on.</P> <P>kind regards</P> Mon, 24 Oct 2016 14:41:33 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270431#M31365 TStrauch 2016-10-24T14:41:33Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270432#M31366 <P>Thank you very much.I don't have words to say. <BR /> I will try to understand.<BR /> Thanks<BR /> Best Regard ^^</P> Mon, 24 Oct 2016 14:45:58 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270432#M31366 Nesrinepfe 2016-10-24T14:45:58Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270433#M31367 <P>Hi,</P> <P>Netflow Analytics for Splunk App goes with this Add-on <A href="https://splunkbase.splunk.com/app/1838/">https://splunkbase.splunk.com/app/1838/</A>. </P> <P>You also need to download NetFlow Integrator (<A href="https://www.netflowlogic.com/download/">https://www.netflowlogic.com/download/</A>), which handles Palo Alto Networks NetFlow templates. </P> <P>Best Regards.</P> Mon, 24 Oct 2016 15:28:24 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270433#M31367 NetFlow_Logic 2016-10-24T15:28:24Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270434#M31368 <P>Hello,</P> <P>You could also try the Scrutinizer add on for Splunk: <A href="https://www.plixer.com/splunk-integration.html">https://www.plixer.com/splunk-integration.html</A> which includes extensive support for Palo Alto: <A href="https://www.plixer.com/palo-alto-networks-integration.html">https://www.plixer.com/palo-alto-networks-integration.html</A>.</P> <P>Now you have a couple choices. </P> <P>Hope this helps. </P> Tue, 25 Oct 2016 06:56:20 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270434#M31368 jakemichaelwils 2016-10-25T06:56:20Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270435#M31369 <P>Thank you very much for your suggestion <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> I will check it.<BR /> Best regards ^^</P> Tue, 25 Oct 2016 08:51:30 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Netflow-Analytics-for-Splunk-Why-am-I-unable-to-see-data-from/m-p/270435#M31369 Nesrinepfe 2016-10-25T08:51:30Z