topic Re: How can I index Netflow? in Getting Data In

How can I index Netflow?

Dan — Tue, 29 Jun 2010 22:35:41 GMT

I want to be able to search netflow data to find suspicious conversations (i.e. someone opening a connection and closing it right away). Is there a way to get a netflow feed into Splunk?

Re: How can I index Netflow?

rayfoo — Wed, 30 Jun 2010 00:22:24 GMT

Yes.

http://www.splunk.com/wiki/Apps:TrafficFlows

Re: How can I index Netflow?

maverick — Wed, 18 Aug 2010 20:59:33 GMT

Netflow data is binary and, even though you could splunk it like that, it would not be useful in that form inside your Splunk GUI while searching. Therefore, the flow will need to be converted to humanly-readable text first via some NetFlow-2-Text converter, such as the ones mentioned at the "TrafficFlows" link provided in the previous answer.

Once converted to text, however, you could then easily setup Splunk to listen on any open tcp or udp port for incoming converted flow streams and just send the it directly to that port and SPlunk will index it in real time.

Re: How can I index Netflow?

maverick — Fri, 18 Mar 2011 09:33:08 GMT

See this link for the Splunk for Netflow App: http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+for+NetFlow

Re: How can I index Netflow?

NetFlow_Logic — Mon, 21 Jan 2013 23:31:28 GMT

"Splunk for NetFlow" App is replaced with "NetFlow for Splunk". See this link: http://splunk-base.splunk.com/apps/22328/netflow-for-splunk-powered-by-netflow-integrator

Re: How can I index Netflow?

NetFlow_Logic — Mon, 10 Mar 2014 18:31:25 GMT

All previously existing versions of NetFlow Logic Splunk apps have been merged into one NetFlow for Splunk by NetFlow Logic App. See this link http://apps.splunk.com/app/489/