topic netflow data captured but not being displayed in Getting Data In

netflow data captured but not being displayed

dodes — Thu, 16 Aug 2012 13:10:02 GMT

I'm running on Ubuntu 12.04.1.

This issue I am struggling with is that netflow is not displaying the data captured. The nfdump.log file is in the location /opt/splunk/etc/apps/netflow/log/nfdump and a cat of the file indicates that the flows are being recorded properly yet when I go to the dashboard no matter what criteria i use it indicates 'no results found'.

Any thoughts on where to look?

Thanks.

Re: netflow data captured but not being displayed

jonathanmorcom — Mon, 27 Aug 2012 12:20:53 GMT

I'm having same issue on Debian...

Re: netflow data captured but not being displayed

jonathanmorcom — Mon, 28 Sep 2020 12:21:01 GMT

the app appears to be missing the index location in inputs.conf.

add this to each stanzer and it will work.

vim /opt/splunk/etc/apps/netflow/default/inputs.conf

add index=netflow_si_traffic to the 3 stanzer in the file and restart splunk.