All Apps and Add-ons

How to decode netflow_elements Key Values pair?

pkarpushin
Path Finder

I have configured splunk stream app to collect netflow data from network.
Incoming data is being collected and indexed well, however some fields in search output are shown as below:

input_snmpidx:   6  
netflow_elements:   [   [-] 
         UNKNOWN : 0ab132f5 
         UNKNOWN : 0ab1320b 
         UNKNOWN : 9f99 
         UNKNOWN : 00a1 
         UNKNOWN : 02   
         UNKNOWN : 07e9 
    ]   

Netflow exporter device is Cisco ASA Version 8.4(4)1.
I need to know an approach how to display these fields in a correct way.

Tags (2)
0 Karma

dhruvilbhatt
New Member

Hi @pkarpushin , 

Did you find a solution to this issue? I am facing the exactly same issue in my environment. I tried following THIS Splunk doc, but it didn't work. 

Let me know if you have any leads on this. 

0 Karma

Stan816
Explorer

I have a similar challenge - just a different source. Did anyone find an suitable approach?

netflow_elements: [ [-]
5951.638 : 0000
5951.352 : 0002
5951.353 : 2a91b70a
]

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Stan816 - 

I’m a Community Moderator in the Splunk Community. Thanks for contributing as a member in the forum!

This question was posted 4 years ago and might not get the attention you need for your own question to be answered. I suggest you please post a brand new question with proper details about the issue you are facing so your issue can get more visibility. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.

0 Karma

fox27374
New Member

Hi, did you manage to decode these values? I have the same problem with Cisco High Speed Logging.

Thanks!

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...