topic Re: Differentiate Netflow sources in Splunk Stream in All Apps and Add-ons

Differentiate Netflow sources in Splunk Stream

rtiulmankov — Mon, 28 Aug 2017 14:58:28 GMT

I have multiple devices sending Netflow v5 data to Splunk Stream. And they are all being captured by one stream. Is there any way to differentiate sources of netflow data without installing separate splunk stream forwarders for each device? I tried to use exporter_ip field with no luck - it's just empty. They are all sending data to different ports on the splunk stream, but I don't see this information in splunk index. May be there is some way to configure Splunk Stream to send data to separate streams based on the port numbers that the data is being captured on?

Thanks,
Roman

Re: Differentiate Netflow sources in Splunk Stream

vshcherbakov_sp — Mon, 28 Aug 2017 16:13:02 GMT

I believe exporter_ip being empty is a bug that will (hopefully) be addressed in the next Stream maintenance release. Unfortunately short of installing multiple instances of stream I can't think of a way to differentiate netflow data sources in your case..

Re: Differentiate Netflow sources in Splunk Stream

rtiulmankov — Mon, 28 Aug 2017 16:43:06 GMT

Thanks, vshcherbakov

Re: Differentiate Netflow sources in Splunk Stream

Ashitakakun — Wed, 30 Aug 2017 13:54:38 GMT

Hi! i had the same problem, but i switched to Netflow V9 and it worked 🙂

Re: Differentiate Netflow sources in Splunk Stream

joshd — Wed, 30 Aug 2017 20:53:13 GMT

Is there any target date for the next maintenance release? Same issue here with an environment gearing up to have 150+ devices sending NF 😞

Re: Differentiate Netflow sources in Splunk Stream

kmarciniak — Thu, 10 Oct 2019 20:55:59 GMT

What version of Stream is this exporter_ip broken and what version fixes it? Is there an SPL number?