All Apps and Add-ons

Already existing .PCAP to SPLUNK

boromir
Path Finder

Hi all,

I need some support regarding ingestion of .pcap files to SPLUNK. 

We have another application that already creates .pcap files in a directory, and they rotate in a good enough manner.... on all of the needed machines(and I already have UF there as I am ingesting log files from these machines). I do not want /or need to push splunk to create new pcaps for me. I just want to transfer the files to SPLUNK, and hopefully be able to then analyze them there.

I have read what I found regarding Stream App, and I have to say it is a bit inconsistent and unclear. I have architecture with UFs->HFs->IDXs->SHs.

We have installed Stream app on the SH, the TA_stream on the SH, Indexers and HFs, I have Stream installed on UF as well. However I still do not see option for PCAPs in Data Input menu of settings. 

It is probably lack of configuration on my side, but I fail to find the documentation how to configure the app on each of the nodes. SPLUNK is 9.0.2/on Linux

If someone has already gone through that challenge, I'd appreciate a piece of advice.

 

 

Labels (2)
Tags (2)
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...