My flow receiver shows Inactive under stream forwarder status no matter what I do. Trying to deduce the problem and suggestions would be nice. I have checked and I am getting packets but nothing being displayed.
Have you tried explicitly declaring the receiver ip in the netflowReceiver..ip parmeter under the [streamfwd] stanza in the local/streamfwd.conf file?
Once had an instance of Splunk Stream where netflowReceiver..ip=localhost or netflowReceiver..ip=127.0.0.1 would NOT work.
https://docs.splunk.com/Documentation/StreamApp/7.1.3/DeployStreamApp/ConfigureFlowcollector
Hope it helps
What cause the stream forwarder to be inactive?
