Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- A wrong configuration script (configure.sh) in Spl...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This post is not a question, but an enhancement request for Splunk Add-on for NetFlow Ver 3.0.1.
I installed Splunk Enterprise 6.2.5 and Splunk Add-on for NetFlow Ver 3.0.1 on a Linux server and configured it by "configure.sh" in this add-on.
Though I've done this almost default settings and transferred netflow packets to this UDP receiving port, I could not get any netflow packets in Splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In some tests, I got a solution to this issue.
I found that "configure.sh" may be wrong.
Original "configure.sh" in this App (Ver 3.0.1) includes following lines.
let keepDays=$keepDays-1
if [[ -z "$keepDays" ]]; then
keepDays="2"
fi
This causes wrong days to keep ascii flow logs in flowfix.sh which is executed by script stanza in inputs.conf.
find /opt/splunk625/etc/apps/Splunk_TA_flowfix/nfdump-ascii -type f -mtime +-1 -exec rm -f {} \;
So if you encounter this issue, you need to change flowfix.sh manually, or specify custom days during its configurations.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have also found this bug. Enter the days manually or change the script to do the null comparison first.
Disappointing that this has been out there for over a year and hasn't been fixed yet.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the script has major errors which results in a broken flowfix.sh file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In some tests, I got a solution to this issue.
I found that "configure.sh" may be wrong.
Original "configure.sh" in this App (Ver 3.0.1) includes following lines.
let keepDays=$keepDays-1
if [[ -z "$keepDays" ]]; then
keepDays="2"
fi
This causes wrong days to keep ascii flow logs in flowfix.sh which is executed by script stanza in inputs.conf.
find /opt/splunk625/etc/apps/Splunk_TA_flowfix/nfdump-ascii -type f -mtime +-1 -exec rm -f {} \;
So if you encounter this issue, you need to change flowfix.sh manually, or specify custom days during its configurations.
Building Reliable Asset and Identity Frameworks in Splunk ES
Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting
Automatic Discovery Part 3: Practical Use Cases
