All Apps and Add-ons

NetFlow Analytics for Splunk - Do I need to set the sourcetype manually?

kurelig
New Member

I just installed the App yesterday on Splunk 6.4.1 on Windows 7 Pro 32 bit machine. I have added data input UDP port 995.
Looks like i need to set the source type as NetFlow but I don't see it listed. Am I supposed to create a source type manually?

I see packets arriving from a Cisco Router on this Windows 7 Pro destined to port 9995 but nothing shows up on the App dashboard.

0 Karma
1 Solution

NetFlow_Logic
Contributor

This App relies on flow data processed by NetFlow Optimizer™ (NFO). You need to download it from https://www.netflowlogic.com/downloads/ and install it on a server or VM. Your Cisco Router should be configured to send NetFlow to NFO. NFO will optimize binary flow data and send optimized flow information to Splunk.

You also need Technology Add-on for NetFlow (TA-netflow) on your search heads, indexers, and forwarders. To download TA-netflow please visit https://splunkbase.splunk.com/app/1838/

Please contact trial@netflowlogic.com if you have questions or need further assistance.

View solution in original post

0 Karma

kurelig
New Member

Is there a step by step guide to set this up from start to finish?

Router---NFO---Splunk (NetFlow Analytics App + NetFlow Add On)

K
0 Karma

NetFlow_Logic
Contributor

You can check documentation page here https://www.netflowlogic.com/resources/documentation/.

NetFlow Optimizer Overview - contains component descriptions and various deployment scenarios to match your Splunk deployment.

Installation and Administration Guide - describes how to install, upgrade, and configure NetFlow Optimizer. It also includes system requirements.

NetFlow Analytics for Splunk User Manual - describes how to install and configure NetFlow Analytics for Splunk App and Technology Add-on for NetFlow (TA-netflow).

0 Karma

NetFlow_Logic
Contributor

This App relies on flow data processed by NetFlow Optimizer™ (NFO). You need to download it from https://www.netflowlogic.com/downloads/ and install it on a server or VM. Your Cisco Router should be configured to send NetFlow to NFO. NFO will optimize binary flow data and send optimized flow information to Splunk.

You also need Technology Add-on for NetFlow (TA-netflow) on your search heads, indexers, and forwarders. To download TA-netflow please visit https://splunkbase.splunk.com/app/1838/

Please contact trial@netflowlogic.com if you have questions or need further assistance.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...