All Apps and Add-ons

Differentiate Netflow sources in Splunk Stream

rtiulmankov
Explorer

I have multiple devices sending Netflow v5 data to Splunk Stream. And they are all being captured by one stream. Is there any way to differentiate sources of netflow data without installing separate splunk stream forwarders for each device? I tried to use exporter_ip field with no luck - it's just empty. They are all sending data to different ports on the splunk stream, but I don't see this information in splunk index. May be there is some way to configure Splunk Stream to send data to separate streams based on the port numbers that the data is being captured on?

Thanks,
Roman

Tags (2)
1 Solution

vshcherbakov_sp
Splunk Employee
Splunk Employee

I believe exporter_ip being empty is a bug that will (hopefully) be addressed in the next Stream maintenance release. Unfortunately short of installing multiple instances of stream I can't think of a way to differentiate netflow data sources in your case..

View solution in original post

Ashitakakun
New Member

Hi! i had the same problem, but i switched to Netflow V9 and it worked 🙂

0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

I believe exporter_ip being empty is a bug that will (hopefully) be addressed in the next Stream maintenance release. Unfortunately short of installing multiple instances of stream I can't think of a way to differentiate netflow data sources in your case..

joshd
Builder

Is there any target date for the next maintenance release? Same issue here with an environment gearing up to have 150+ devices sending NF 😞

kmarciniak
Path Finder

What version of Stream is this exporter_ip broken and what version fixes it? Is there an SPL number?

0 Karma

rtiulmankov
Explorer

Thanks, vshcherbakov

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...