All Apps and Add-ons

How to get the Splunk App for Stream to capture both interfaces on my machine, not just one?

Communicator

Hi to everyone

I have a new Splunk instance with the Splunk App for Stream with default installation. In my machine, I have two interfaces: the first, for Internet, and the second, in promiscuous mode, with the whole network traffic (I'm sure about that, I saw it in Wireshark).
However, in Splunk App for Stream, I can only see the first interface, traffic. How can I solve this?

Thanks you very much

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Hello rubeniturrieta,

you need to specify the interface you want App for Stream to capture on in etc/apps/Splunk_TA_stream/local/streamfwd.xml file. See http://docs.splunk.com/Documentation/StreamApp/6.3.0/DeployStreamApp/ConfigureStreamForwarder#Use_XM...

HTH

View solution in original post

Splunk Employee
Splunk Employee

Hello rubeniturrieta,

you need to specify the interface you want App for Stream to capture on in etc/apps/Splunk_TA_stream/local/streamfwd.xml file. See http://docs.splunk.com/Documentation/StreamApp/6.3.0/DeployStreamApp/ConfigureStreamForwarder#Use_XM...

HTH

View solution in original post