Captured traffic with Wireshark and Splunk app for Stream

[rubeniturrieta]

Hi to everyone

I have a new splunk instance, with Splunk App for Stream with default installation. In my machine, i have captured traffic with Wireshark (two weeks), in a folder. I need this traffic (.pcap) for Splunk App for Stream. Someone knows how to solve this?

Thanks you very much

[mdickey_splunk · Accepted solution]

If the pcap files are on the same machine that your "Wire Data Input" data input (streamfwd) is running on, you should be able to use the command line parameters to send the pcap files to it. See http://docs.splunk.com/Documentation/StreamApp/6.3.0/DeployStreamApp/streamfwdcommandlineoptions#Rea...

Note that the streamfwd binary is platform specific. So.. if you have App for Stream installed on a 64-bit Linux server, and you have enabled the Wire Data data input (you should be able to see it's UI at http://your_hostname:8889), and you have Splunk installed in /opt/splunk:

/opt/splunk/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwd -r <pcap files>

If you're on OSX instead, it would be:

/opt/splunk/etc/apps/Splunk_TA_stream/darwin_x86_64/bin/streamfwd -r <pcap files>

[hemendralodhi]

Hi,

Can we constantly monitor and index a pcap file generated on another machine to be able to use with Stream app?

Thanks
Hemendra

[mdickey_splunk]

There currently is no way for Stream to monitor a directory for new pcap files and automatically load them. You would need to write a script that does this, and calls the above command whenever a new file is available.

[hemendralodhi]

Thanks for your response. I will check on that and update.