Differentiate Netflow sources in Splunk Stream

[rtiulmankov]

I have multiple devices sending Netflow v5 data to Splunk Stream. And they are all being captured by one stream. Is there any way to differentiate sources of netflow data without installing separate splunk stream forwarders for each device? I tried to use exporter_ip field with no luck - it's just empty. They are all sending data to different ports on the splunk stream, but I don't see this information in splunk index. May be there is some way to configure Splunk Stream to send data to separate streams based on the port numbers that the data is being captured on?

Thanks,
Roman

[Ashitakakun]

Hi! i had the same problem, but i switched to Netflow V9 and it worked 🙂

[vshcherbakov_sp · Accepted solution]

I believe exporter_ip being empty is a bug that will (hopefully) be addressed in the next Stream maintenance release. Unfortunately short of installing multiple instances of stream I can't think of a way to differentiate netflow data sources in your case..

[joshd]

Is there any target date for the next maintenance release? Same issue here with an environment gearing up to have 150+ devices sending NF 😞

[kmarciniak]

What version of Stream is this exporter_ip broken and what version fixes it? Is there an SPL number?

[rtiulmankov]

Thanks, vshcherbakov