topic Indexing a NetFlow logic - log file. in Getting Data In

Indexing a NetFlow logic - log file.

chimbudp — Mon, 28 Sep 2020 15:44:58 GMT

I have configured the inputs.conf to monitor the log file of NetFlow logic
Since the log file is in unreadable format , i set the props.conf to NO_BINARY_CHECK =1

After that i receive the logs in the below format . Is this the correct one ? am i missing something here ?

2014-01-29T05:56:35+00:00 10.0.255.245
\x84R\xE8\x98%\x00d\xD2I\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
\xA6\xA3\x00{\x00\x00\x96\x00\x00
: \x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00\xCC\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
"\xB3\xDE\x00\x00\x96\x00\x00
\x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00-\x00\x00\x00\x00\x00\x00\x00 \xAC
\xAC
\xB3\xDE"\x00\x00\xC6\x00\x00
\x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00\x00\xA4\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
"\xB3\xDD\x00\x00\x96\x00\x00
\x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00\xB0\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC

Re: Indexing a NetFlow logic - log file.

Ayn — Wed, 29 Jan 2014 07:34:47 GMT

Without knowing the exact format of the file - if the file is in a binary format, you shouldn't be pointing Splunk to read it directly. Splunk has no magic "decoding" of binary files, it indexes what it gets as-is. All you achieve by setting NO_BINARY_CHECK is to force Splunk to read all that non-readable data even though it doesn't make sense to do so.

What you need is something that will decode this data from the binary format to a textual representation of it, and then have Splunk read that output instead. Again, I don't know the exact format of this file that you're referring to, but some kind of flow reader would do this.

Re: Indexing a NetFlow logic - log file.

MuS — Wed, 29 Jan 2014 07:40:34 GMT

or like the further south located fruit company would say, there is an app for it 😉 http://apps.splunk.com/app/489/