topic Re: Can cflowd format be Splunked? in Getting Data In

Can cflowd format be Splunked?

juthsn — Tue, 03 Feb 2015 07:30:45 GMT

Hello.
A customer is getting external firewall logs from a vendor in "cflowd format".
Can cflowd format be Splunked? If so, any documentation or info re the same would be awesome.

Thanks.

Re: Can cflowd format be Splunked?

MuS — Tue, 03 Feb 2015 07:51:19 GMT

Hi juthsn,

the answer is as easy as this:

If this format is human readable: yes, Splunk can index it.
If this format is binary/non-readable by humans: no, Splunk cannot index it.

For the later, you could still use some external conversion script and have the output of this script index by Splunk.

hope this helps ...

cheers, MuS

Re: Can cflowd format be Splunked?

juthsn — Tue, 10 Feb 2015 10:16:04 GMT

Hi, let me rephrase then 🙂
Has anybody worked with this format before? We have never seen the raw data in this type of file and are not sure if it is human readable ascii.
Wasn't able to find a sample file either.

Thanks!

Re: Can cflowd format be Splunked?

MuS — Tue, 10 Feb 2015 11:15:03 GMT

After some googling I learned that cflowd is a flow analysis tool that was used for analyzing Cisco's NetFlow enabled switching method So, if it uses netflow you can check out any of the netflow apps https://apps.splunk.com/apps/#/search/netflow/page/1 maybe they can be of help in this case