All Apps and Add-ons

FlowReciever Inactive

colinregan
New Member

My flow receiver shows Inactive under stream forwarder status no matter what I do. Trying to deduce the problem and suggestions would be nice. I have checked and I am getting packets but nothing being displayed.

0 Karma

jaime_ramirez
Communicator

Have you tried explicitly declaring the receiver ip in the netflowReceiver..ip parmeter under the [streamfwd] stanza in the local/streamfwd.conf file?

Once had an instance of Splunk Stream where netflowReceiver..ip=localhost or netflowReceiver..ip=127.0.0.1 would NOT work.

https://docs.splunk.com/Documentation/StreamApp/7.1.3/DeployStreamApp/ConfigureFlowcollector

Hope it helps

0 Karma