Hello I have Splunk Streams installed on a Centos 6 Server which is also acting as a NFS Server. This is capturing packets and writing pcaps to the correct directory.
I have a Windows Search head where I have installed the Splunk Streams App. I am trying to download pcaps from the Search Head but hitting a problem.
Under windows I have the NFS Share which stores the Pcaps mounted as my S:\ drive.
When I look under the S:\ drive I can see folders arranged by date order with subfolders which contain the pcaps.
Under App:Splunk Stream ->Confgiuration I have:
FileSever X.X.X.X:/Splunkstream
Mount Point: S:\
However when I try and download a PCAP from the search head I get the error:
Unable to download PCAP file
The configured mount point (S:) for file serverX.X.X.X:/SplunkStream does not exist.
You can edit the configured value if it is incorrect.
Read more about Targeted Packet Capture
Any ideas?
I'm not sure If I'm allowed to answer my own question, but the solution was to have the mount point written as the a UNC path.
So rather than S:\
it was: \x.x.x.x\var\nfsshares\SplunkStream
where x.x.x.x is the IP of the remote server hosting the NFS Share.
I'm not sure If I'm allowed to answer my own question, but the solution was to have the mount point written as the a UNC path.
So rather than S:\
it was: \x.x.x.x\var\nfsshares\SplunkStream
where x.x.x.x is the IP of the remote server hosting the NFS Share.