All Apps and Add-ons

How to configure a 2nd network interface for Splunk App for Stream?

New Member

My Splunk server has two gigabit NICs (eth0 and eth1), both on the same subnet.

eth0 and its assigned IP address is where the main Splunk interface is accessed by other hosts on the subnet (both to access the interface via a web browser, and also to forward log data via syslog or forwarders).

I have connected a SPAN port on my switch to eth1 on my Splunk server. This SPAN port is a mirror of the switch port used by 'Server A' (which is also running the Splunk Universal Forwarder).

I've got the Splunk App for Stream installed and running, but cannot work out how get it to 'listen' on traffic arriving on eth1. In other words, I just want the the Stream app to collect network traffic pertaining to 'Server A' and nothing else. But at present, it seems to be collecting traffic related to the Splunk server itself, which suggests the Stream app is simply 'listening' on eth0.

Please can someone tell me how to configure multiple NICs within Splunk, and also if this is the correct approach to get the Stream App to collect Cisco SPAN port traffic?


0 Karma

Splunk Employee
Splunk Employee

Do you have any explicit network interface configuration set up? You can tell Splunk_TA_stream (the network capture part of Stream) to listen to a specific interface via streamfwd.xml config file -

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...