All Apps and Add-ons

Has anyone compared using Splunk's netmon vs the Splunk App for Stream?

ss1210
New Member

Hi,

Has anyone compared the usage of the Splunk basic Netmon vs the Splunk App for Stream? I'm trying to get summary data from azure hosts. I am looking for something basic where we watch for the unexpected. So we would ignore inbound 80/443, but watch outbound random ports, etc....

It looks like the Stream App would be a pretty high volume of index data. I don't need the whole packets, just connection summary like what you would get from a cisco or firewall device.

Has anyone looked at both and can you offer advice on if stream would be overkill or maybe the filter language lets us get more specific to watching what we want?

Thank you!

Tags (1)
0 Karma
1 Solution

mdickey_splunk
Splunk Employee
Splunk Employee

Stream does not store packets (this is a very common misconception). Instead it generates events derived from the data contained in the packets. It has extensive capabilities for filtering, aggregation, etc. that limit and control the events it generates so that you don't have to store any more data than you want. If you're trying to get events into Splunk from wire data (or network traffic), Stream is (almost*) always the best way to do it.

*The only exceptions I can think of is when you already have another system in place generating the data you want, for example you only want NetFlow data (a small subset of what stream provides), and you already have a switch in place that generates this data for you. In this case (and assuming there is already an Splunk app available, as there is for NetFlow data), it may be easier to go that route versus using Stream.

View solution in original post

mdickey_splunk
Splunk Employee
Splunk Employee

Stream does not store packets (this is a very common misconception). Instead it generates events derived from the data contained in the packets. It has extensive capabilities for filtering, aggregation, etc. that limit and control the events it generates so that you don't have to store any more data than you want. If you're trying to get events into Splunk from wire data (or network traffic), Stream is (almost*) always the best way to do it.

*The only exceptions I can think of is when you already have another system in place generating the data you want, for example you only want NetFlow data (a small subset of what stream provides), and you already have a switch in place that generates this data for you. In this case (and assuming there is already an Splunk app available, as there is for NetFlow data), it may be easier to go that route versus using Stream.

ss1210
New Member

That's great, thank you!

0 Karma

piebob
Splunk Employee
Splunk Employee

please accept the answer if it worked for you. thanks!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...