https://community.splunk.com/t5/Getting-Data-In/Ingesting-cisco-netflow-HSL-messages/m-p/560316#M92615 <P>Hi all, so I've been trying to ingest cisco netflow logs into my splunk environment, and finally got the logs in with Splunk Stream.</P><P>However, there's a field "src_content" which seems to be unable to parse or read by splunk, and its appearing as symbols. I'm suspecting itt is due to cisco netflow sending them via High-Speed Logging. Is there a template for splunk to decode these?</P><P>It looks like this for eg.</P><P>src_content:</P><P><SPAN><SPAN class="key level-1"><SPAN class="t string">&#1; "��`��f&#1;^P&#1;,&#1;&#4;d�&#16;&#1;&#31;N�q�����&#6;&#3;�l��&#20;&#1;z�so#(&#19;&#14;���&#11; </SPAN></SPAN></SPAN></P> Wed, 21 Jul 2021 10:14:43 GMT d_lim 2021-07-21T10:14:43Z https://community.splunk.com/t5/Getting-Data-In/Ingesting-cisco-netflow-HSL-messages/m-p/560316#M92615 <P>Hi all, so I've been trying to ingest cisco netflow logs into my splunk environment, and finally got the logs in with Splunk Stream.</P><P>However, there's a field "src_content" which seems to be unable to parse or read by splunk, and its appearing as symbols. I'm suspecting itt is due to cisco netflow sending them via High-Speed Logging. Is there a template for splunk to decode these?</P><P>It looks like this for eg.</P><P>src_content:</P><P><SPAN><SPAN class="key level-1"><SPAN class="t string">&#1; "��`��f&#1;^P&#1;,&#1;&#4;d�&#16;&#1;&#31;N�q�����&#6;&#3;�l��&#20;&#1;z�so#(&#19;&#14;���&#11; </SPAN></SPAN></SPAN></P> Wed, 21 Jul 2021 10:14:43 GMT https://community.splunk.com/t5/Getting-Data-In/Ingesting-cisco-netflow-HSL-messages/m-p/560316#M92615 d_lim 2021-07-21T10:14:43Z