All Apps and Add-ons

Differentiate Netflow sources in Splunk Stream

Explorer

I have multiple devices sending Netflow v5 data to Splunk Stream. And they are all being captured by one stream. Is there any way to differentiate sources of netflow data without installing separate splunk stream forwarders for each device? I tried to use exporter_ip field with no luck - it's just empty. They are all sending data to different ports on the splunk stream, but I don't see this information in splunk index. May be there is some way to configure Splunk Stream to send data to separate streams based on the port numbers that the data is being captured on?

Thanks,
Roman

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

I believe exporter_ip being empty is a bug that will (hopefully) be addressed in the next Stream maintenance release. Unfortunately short of installing multiple instances of stream I can't think of a way to differentiate netflow data sources in your case..

View solution in original post

New Member

Hi! i had the same problem, but i switched to Netflow V9 and it worked 🙂

0 Karma

Splunk Employee
Splunk Employee

I believe exporter_ip being empty is a bug that will (hopefully) be addressed in the next Stream maintenance release. Unfortunately short of installing multiple instances of stream I can't think of a way to differentiate netflow data sources in your case..

View solution in original post

SplunkTrust
SplunkTrust

Is there any target date for the next maintenance release? Same issue here with an environment gearing up to have 150+ devices sending NF 😞

Path Finder

What version of Stream is this exporter_ip broken and what version fixes it? Is there an SPL number?

0 Karma

Explorer

Thanks, vshcherbakov

0 Karma