https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123598#M184212 <P>Should work. There's a long list of questions about your environment we need to ask to help troubleshoot. Given the amount of detailed work that needs to happen, support is probably a better option than Answers.</P> Mon, 15 Sep 2014 17:46:12 GMT csharp_splunk 2014-09-15T17:46:12Z https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123595#M184209 <P>I have a pcap with DNS traffic that I want to analyze. I downloaded the 'Stream Examples' app and the main Splunk App for Stream. There is a Stream Replay input option which I pointed at my .pcap but I don't see any data. I have the 'streamfwd' enabled and I don't see any data related to that either. I followed the Install guide for all this so I am not sure what else to do here.</P> <P>Any help or troubleshooting options would be helpful.</P> Fri, 12 Sep 2014 20:41:00 GMT https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123595#M184209 sswansonchtr 2014-09-12T20:41:00Z https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123596#M184210 <P>What operating system are you running?</P> Sun, 14 Sep 2014 19:24:29 GMT https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123596#M184210 csharp_splunk 2014-09-14T19:24:29Z https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123597#M184211 <P>Red Hat Enterprise Linux Server release 5.7 (Tikanga)</P> Mon, 15 Sep 2014 15:57:10 GMT https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123597#M184211 sswansonchtr 2014-09-15T15:57:10Z https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123598#M184212 <P>Should work. There's a long list of questions about your environment we need to ask to help troubleshoot. Given the amount of detailed work that needs to happen, support is probably a better option than Answers.</P> Mon, 15 Sep 2014 17:46:12 GMT https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123598#M184212 csharp_splunk 2014-09-15T17:46:12Z https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123599#M184213 <P>I will contact support. The environment is straightforward VM install with a base splunk install I use for importing logs to troubleshoot.</P> Mon, 15 Sep 2014 21:11:07 GMT https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123599#M184213 sswansonchtr 2014-09-15T21:11:07Z https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123600#M184214 <P>What link layer your pcap file has? App for Stream only support ethernet, linux cooked sockets and DLT_NULL link types. Wireshark should be able to tell you the link type; you may also want to look for "SnifferReactor unrecognized link layer for device " error messages in the streamfwd.log file</P> Thu, 12 Feb 2015 00:06:26 GMT https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123600#M184214 vshcherbakov_sp 2015-02-12T00:06:26Z https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123601#M184215 <P>Were you able to edit the streamfwd.xml config file in the local directory for your Splunk Stream instance? Check out this link, it goes over setting up Splunk Stream to look at a specific PCAP file : <A href="+https://answers.splunk.com/answers/220040/running-stream-against-old-pcaps.html">https://answers.splunk.com/answers/220040/running-stream-against-old-pcaps.html</A></P> <P>I hope that helps!</P> Thu, 14 Jan 2016 21:13:14 GMT https://community.splunk.com/t5/Splunk-Search/App-for-Stream-pcap-replay/m-p/123601#M184215 amiracle 2016-01-14T21:13:14Z