How can I index Netflow logs?

[khanlarloo]

Hi,
I want to send my router's Netflow logs to Splunk.
How can I do that?
I installed Splunk in Linux Centos 7 and installed the Splunk Add-on for NetFlow, but my logs still don't show in Splunk.

[nickhills · Accepted solution]

Take a look at Splunk Stream - its a far more robust way of collecting the data (and lots more)!
https://docs.splunk.com/Documentation/StreamApp/7.1.1/DeployStreamApp/ConfigureFlowcollector

[khanlarloo]

should i install netflow programm to collect my data and then send them to splunk?

[nickhills]

If you install Splunk TA Stream on a Heavy Forwarder you have all the components you need.

From the doc above:
edit

[streamfwd]
netflowReceiver.0.ip = <your hvy fwd ip>
netflowReceiver.0.port = 9995
netflowReceiver.0.decoder = netflow

then configure your network devices to send netflow to <your hvy fwd id> :9995

[gjanders]

Depending on the volume of traffic you may want to install the independent stream forwarder...

[khanlarloo]

tanx i do it and it works