topic How do I capture and index these TCP events in Splunk? in Getting Data In

How do I capture and index these TCP events in Splunk?

lavkush — Tue, 23 Aug 2016 11:49:33 GMT

Hello Team,

Would be great to know how do I capture the following alerts in Splunk.

1) TCP Connect Request
2) TCP Disconnect Request
3) TCP Connect Confirm
4) TCP Disconnect Confirm

I need to sniff the local network and capture these in Splunk.
Please direct us to the appropriate portal/page.

Regards,
Ravi.

Re: How do I capture and index these TCP events in Splunk?

skoelpin — Tue, 23 Aug 2016 13:12:18 GMT

You can set up the stanza in your inputs.conf to capture the TCP traffic. You can tie the request/response together using a transaction command which will alert if there's no response to the request

http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Monitornetworkports