Has anyone compared using Splunk's netmon vs the Splunk App for Stream?

[ss1210]

Hi,

Has anyone compared the usage of the Splunk basic Netmon vs the Splunk App for Stream? I'm trying to get summary data from azure hosts. I am looking for something basic where we watch for the unexpected. So we would ignore inbound 80/443, but watch outbound random ports, etc....

It looks like the Stream App would be a pretty high volume of index data. I don't need the whole packets, just connection summary like what you would get from a cisco or firewall device.

Has anyone looked at both and can you offer advice on if stream would be overkill or maybe the filter language lets us get more specific to watching what we want?

Thank you!

[mdickey_splunk · Accepted solution]

Stream does not store packets (this is a very common misconception). Instead it generates events derived from the data contained in the packets. It has extensive capabilities for filtering, aggregation, etc. that limit and control the events it generates so that you don't have to store any more data than you want. If you're trying to get events into Splunk from wire data (or network traffic), Stream is (almost*) always the best way to do it.

*The only exceptions I can think of is when you already have another system in place generating the data you want, for example you only want NetFlow data (a small subset of what stream provides), and you already have a switch in place that generates this data for you. In this case (and assuming there is already an Splunk app available, as there is for NetFlow data), it may be easier to go that route versus using Stream.

[ss1210]

That's great, thank you!

[piebob]

please accept the answer if it worked for you. thanks!