All Apps and Add-ons

Captured traffic with Wireshark and Splunk app for Stream

Communicator

Hi to everyone

I have a new splunk instance, with Splunk App for Stream with default installation. In my machine, i have captured traffic with Wireshark (two weeks), in a folder. I need this traffic (.pcap) for Splunk App for Stream. Someone knows how to solve this?

Thanks you very much

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

If the pcap files are on the same machine that your "Wire Data Input" data input (streamfwd) is running on, you should be able to use the command line parameters to send the pcap files to it. See http://docs.splunk.com/Documentation/StreamApp/6.3.0/DeployStreamApp/streamfwdcommandlineoptions#Rea...

Note that the streamfwd binary is platform specific. So.. if you have App for Stream installed on a 64-bit Linux server, and you have enabled the Wire Data data input (you should be able to see it's UI at http://your_hostname:8889), and you have Splunk installed in /opt/splunk:

/opt/splunk/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwd -r <pcap files>

If you're on OSX instead, it would be:

/opt/splunk/etc/apps/Splunk_TA_stream/darwin_x86_64/bin/streamfwd -r <pcap files>

View solution in original post

Splunk Employee
Splunk Employee

If the pcap files are on the same machine that your "Wire Data Input" data input (streamfwd) is running on, you should be able to use the command line parameters to send the pcap files to it. See http://docs.splunk.com/Documentation/StreamApp/6.3.0/DeployStreamApp/streamfwdcommandlineoptions#Rea...

Note that the streamfwd binary is platform specific. So.. if you have App for Stream installed on a 64-bit Linux server, and you have enabled the Wire Data data input (you should be able to see it's UI at http://your_hostname:8889), and you have Splunk installed in /opt/splunk:

/opt/splunk/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwd -r <pcap files>

If you're on OSX instead, it would be:

/opt/splunk/etc/apps/Splunk_TA_stream/darwin_x86_64/bin/streamfwd -r <pcap files>

View solution in original post

Contributor

Hi,

Can we constantly monitor and index a pcap file generated on another machine to be able to use with Stream app?

Thanks
Hemendra

0 Karma

Splunk Employee
Splunk Employee

There currently is no way for Stream to monitor a directory for new pcap files and automatically load them. You would need to write a script that does this, and calls the above command whenever a new file is available.

0 Karma

Contributor

Thanks for your response. I will check on that and update.

0 Karma