All Apps and Add-ons

A wrong configuration script (configure.sh) in Splunk Add-on for NetFlow Ver 3.0.1.

sunrise
Contributor

This post is not a question, but an enhancement request for Splunk Add-on for NetFlow Ver 3.0.1.
I installed Splunk Enterprise 6.2.5 and Splunk Add-on for NetFlow Ver 3.0.1 on a Linux server and configured it by "configure.sh" in this add-on.

Though I've done this almost default settings and transferred netflow packets to this UDP receiving port, I could not get any netflow packets in Splunk.

1 Solution

sunrise
Contributor

In some tests, I got a solution to this issue.
I found that "configure.sh" may be wrong.

Original "configure.sh" in this App (Ver 3.0.1) includes following lines.
let keepDays=$keepDays-1
if [[ -z "$keepDays" ]]; then
keepDays="2"
fi

This causes wrong days to keep ascii flow logs in flowfix.sh which is executed by script stanza in inputs.conf.
find /opt/splunk625/etc/apps/Splunk_TA_flowfix/nfdump-ascii -type f -mtime +-1 -exec rm -f {} \;

So if you encounter this issue, you need to change flowfix.sh manually, or specify custom days during its configurations.

View solution in original post

huns0004
Engager

I have also found this bug. Enter the days manually or change the script to do the null comparison first.

Disappointing that this has been out there for over a year and hasn't been fixed yet.

0 Karma

thejohn
Path Finder

the script has major errors which results in a broken flowfix.sh file.

0 Karma

sunrise
Contributor

In some tests, I got a solution to this issue.
I found that "configure.sh" may be wrong.

Original "configure.sh" in this App (Ver 3.0.1) includes following lines.
let keepDays=$keepDays-1
if [[ -z "$keepDays" ]]; then
keepDays="2"
fi

This causes wrong days to keep ascii flow logs in flowfix.sh which is executed by script stanza in inputs.conf.
find /opt/splunk625/etc/apps/Splunk_TA_flowfix/nfdump-ascii -type f -mtime +-1 -exec rm -f {} \;

So if you encounter this issue, you need to change flowfix.sh manually, or specify custom days during its configurations.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!