Can the Splunk App for Stream generate Netflow/IPFIX data?

[vlado]

Netflow/IPFiX data model could be used to capture the data.

[vshcherbakov_sp]

As of version 7.0, Splunk Stream supports collecting Netflow, sFlow and IPFIX data directly

[vshcherbakov_sp · Accepted solution]

Stream doesn't generate the exact Netflow/IPFIX data; the best approximation you can do is to create aggregated tcp and/or udp streams that have src_ip, src_port, dest_ip, dest_port (+any other fields) as key fields and bytes_in/bytes_out/packets_in/packets_out as value fields. That will generate events with NetFlow-like stats. The limitations are: only tcp and udp transport protocols supported; not all netflow fields are supported, etc. so it may or may not work based on your use case.