Hi all,
I need some support regarding ingestion of .pcap files to SPLUNK.
We have another application that already creates .pcap files in a directory, and they rotate in a good enough manner.... on all of the needed machines(and I already have UF there as I am ingesting log files from these machines). I do not want /or need to push splunk to create new pcaps for me. I just want to transfer the files to SPLUNK, and hopefully be able to then analyze them there.
I have read what I found regarding Stream App, and I have to say it is a bit inconsistent and unclear. I have architecture with UFs->HFs->IDXs->SHs.
We have installed Stream app on the SH, the TA_stream on the SH, Indexers and HFs, I have Stream installed on UF as well. However I still do not see option for PCAPs in Data Input menu of settings.
It is probably lack of configuration on my side, but I fail to find the documentation how to configure the app on each of the nodes. SPLUNK is 9.0.2/on Linux
If someone has already gone through that challenge, I'd appreciate a piece of advice.
