topic Re: splunk stream in Splunk Cloud Platform

splunk stream

iherb_0718 — Thu, 21 Jan 2021 18:19:23 GMT

All,

I have a few questions related to splunk stream

1) If a windows computer has splunk stream app installed and it has a UF installed, what are some differences in logging activity will I get between the two?

2) Does the splunk stream app get deployed from the deployment server just as the UF does?

3) Does splunk stream log just web traffic?

Re: splunk stream

scelikok — Thu, 21 Jan 2021 18:58:06 GMT

Hi @iherb_0718,

You can find all information regarding Stream on Splunk docs below;

https://docs.splunk.com/Documentation/StreamApp/7.3.0/DeployStreamApp/AboutSplunkStream

Answers to your questions;

1) Splunk Stream App cannot work standalone it should deployed to UF or Splunk Instance. It adds network traffic capture or PCAP ingestion capabilities to Splunk.

2) You can deploy from deployment server.

3) Supported protocols can be found in documentation. https://docs.splunk.com/Documentation/StreamApp/7.3.0/DeployStreamApp/ProtocolDetection

If this reply helps you an upvote is appreciated.

Re: splunk stream

iherb_0718 — Thu, 21 Jan 2021 19:16:05 GMT

Scelikok, assume I have all the work for splunk stream done on the splunk side. That is I got the splunk stream app deployed to the heavy forwarder. This would still require an app on the client side? The client already has a UF. It wouldn't be just tweaking the UF conf files to get stream?

Re: splunk stream

scelikok — Thu, 21 Jan 2021 19:25:59 GMT

@iherb_0718,

I assume you installed The Splunk App for Stream on Heavy Forwrder to manage Stream configuration on UFs.

You should install "The Splunk Add-on for Stream Forwarders (Splunk_TA_stream)" on every client that you want to collect stream data.

If this reply helps you an upvote is appreciated.