All Apps and Add-ons

NetFlow Analytics for Splunk - Do I need to set the sourcetype manually?

New Member

I just installed the App yesterday on Splunk 6.4.1 on Windows 7 Pro 32 bit machine. I have added data input UDP port 995.
Looks like i need to set the source type as NetFlow but I don't see it listed. Am I supposed to create a source type manually?

I see packets arriving from a Cisco Router on this Windows 7 Pro destined to port 9995 but nothing shows up on the App dashboard.

0 Karma
1 Solution

Contributor

This App relies on flow data processed by NetFlow Optimizer™ (NFO). You need to download it from https://www.netflowlogic.com/downloads/ and install it on a server or VM. Your Cisco Router should be configured to send NetFlow to NFO. NFO will optimize binary flow data and send optimized flow information to Splunk.

You also need Technology Add-on for NetFlow (TA-netflow) on your search heads, indexers, and forwarders. To download TA-netflow please visit https://splunkbase.splunk.com/app/1838/

Please contact trial@netflowlogic.com if you have questions or need further assistance.

View solution in original post

0 Karma

New Member

Is there a step by step guide to set this up from start to finish?

Router---NFO---Splunk (NetFlow Analytics App + NetFlow Add On)

K
0 Karma

Contributor

You can check documentation page here https://www.netflowlogic.com/resources/documentation/.

NetFlow Optimizer Overview - contains component descriptions and various deployment scenarios to match your Splunk deployment.

Installation and Administration Guide - describes how to install, upgrade, and configure NetFlow Optimizer. It also includes system requirements.

NetFlow Analytics for Splunk User Manual - describes how to install and configure NetFlow Analytics for Splunk App and Technology Add-on for NetFlow (TA-netflow).

0 Karma

Contributor

This App relies on flow data processed by NetFlow Optimizer™ (NFO). You need to download it from https://www.netflowlogic.com/downloads/ and install it on a server or VM. Your Cisco Router should be configured to send NetFlow to NFO. NFO will optimize binary flow data and send optimized flow information to Splunk.

You also need Technology Add-on for NetFlow (TA-netflow) on your search heads, indexers, and forwarders. To download TA-netflow please visit https://splunkbase.splunk.com/app/1838/

Please contact trial@netflowlogic.com if you have questions or need further assistance.

View solution in original post

0 Karma