Does Splunk Stream support IPFIX?

[mathiask]

The documentation for Splunk Stream only states NetFlow and sFlow

We are currently have some devices generating Netflow V9 and some dedicated NetFlow Probes generating IPFIX including custom fields.

1. Is IPFIX supported at all?
2. Are IPFIX custom fields supported?

[vshcherbakov_sp · Accepted solution]

@mathiask,

• IPFIX is also supported (I updated the documentation - sorry about the inconvenience).
• Custom fields can be configured, but currently the setup is somewhat involved, so it requires Splunk Professional Services assistance to do that.

[mathiask]

Thanks

I hope we get around to try it out.

A short follow up

1. The given performance test results. The Input bandwidth is the NetFlow network traffic. So it is not generating NF rather receiving and processing it. Is that correct? http://docs.splunk.com/Documentation/StreamApp/7.0.0/DeployStreamApp/FlowCollectorTests
2. Do you intend to replace the Splunk Add-on for NetFlow on the long run by Streams? Since they both provide essentially the same functionality.

[vshcherbakov_sp]

1. Yes, that's correct: Stream receives Netflow/sFlow/IPFIX data, decodes it and generates a Splunk event as configured per the corresponding netflow/sflow type stream(s)
2. Yes, I believe this is the direction we're heading. Stream implementation is more scalable/feature reach, etc.