topic Re: Splunk on WINDOWS - Getting NetFlow into Splunk in Getting Data In

Splunk on WINDOWS - Getting NetFlow into Splunk

staces65 — Tue, 01 Mar 2011 18:43:14 GMT

Hi I'm new to Splunk and the tools looks very interesting - Currently Evaluating to replace ORiON SolarWinds APM.

However I'm a bit stuck.

I'n running Splunk on Windows 2008-R2 x64 and have created a TCP data Input Port 9996 for NetFlow.

I've added the following commands to my router: logging 10.32.110.110 ip flow-export destination 10.32.110.110 9996

But don't seem to be getting anything in Splunk for this hardware. can someone help. I've tried searching the documentation but feel that what woudl be really handy is if someone had a Step By Step Quide for commond configs, such as netFlow, Syslog and Windows Events...

HELP.... 🙂

Thanks In Advance

Re: Splunk on WINDOWS - Getting NetFlow into Splunk

treinke — Tue, 01 Mar 2011 22:39:07 GMT

I would install wireshark on the Windows 2008 server and check to make sure it is receiving the traffic on 9996.

Re: Splunk on WINDOWS - Getting NetFlow into Splunk

dwaddle — Tue, 01 Mar 2011 23:35:57 GMT

I think this has been covered several times in other answers posts. Netflow over-the-wire is not a textual format. It is a very dense binary format, and needs the assistance of some tools to format the netflow binary data into something textual (and therefore consumable by Splunk).

There is an existing app in SplunkBase, http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+for+NetFlow that has some of the necessary plumbing in place. It depends on the nfdump tool from http://nfdump.sourceforge.net/ . Whether or not nfdump works on windows is probably going to be your biggest hurdle to manage.

Some other related answers:

http://answers.splunk.com/questions/10242/how-to-configure-nfdump-to-convert-netflow-data-from-binary-to-text-or-csv

http://answers.splunk.com/questions/8162/how-can-i-use-netflow-in-splunk-when-its-on-a-windows-box-without-buying-more-so

http://answers.splunk.com/questions/4186/how-can-i-index-netflow