All Apps and Add-ons

Can the Splunk App for Stream generate Netflow/IPFIX data?

vlado
Engager

Netflow/IPFiX data model could be used to capture the data.

Tags (2)
0 Karma
1 Solution

vshcherbakov_sp
Splunk Employee
Splunk Employee

Stream doesn't generate the exact Netflow/IPFIX data; the best approximation you can do is to create aggregated tcp and/or udp streams that have src_ip, src_port, dest_ip, dest_port (+any other fields) as key fields and bytes_in/bytes_out/packets_in/packets_out as value fields. That will generate events with NetFlow-like stats. The limitations are: only tcp and udp transport protocols supported; not all netflow fields are supported, etc. so it may or may not work based on your use case.

View solution in original post

vshcherbakov_sp
Splunk Employee
Splunk Employee

As of version 7.0, Splunk Stream supports collecting Netflow, sFlow and IPFIX data directly

vshcherbakov_sp
Splunk Employee
Splunk Employee

Stream doesn't generate the exact Netflow/IPFIX data; the best approximation you can do is to create aggregated tcp and/or udp streams that have src_ip, src_port, dest_ip, dest_port (+any other fields) as key fields and bytes_in/bytes_out/packets_in/packets_out as value fields. That will generate events with NetFlow-like stats. The limitations are: only tcp and udp transport protocols supported; not all netflow fields are supported, etc. so it may or may not work based on your use case.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...