- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Problem ingesting pcap file with stream modular input
I'm attempting to ingest a pcap file per the documentation by using the modular input, and when I go through those steps, the contents of the pcap file is loaded into the stream inputs.conf stanza. I've been able to recreate this on two different systems, both windows and linux. Has anyone run into this and have any suggestions as to how to make this work?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i have created a index for testing and selected that when i ingest the pcap. also i have selected system time. All that happens is that the inputs.conf file has the content of the pcap. I cannot see any data actually in splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Looks like this is to be expected. We thought it was broken because we couldn't find the data once it was ingested. Figured out how to find the data now, and the pcap ingest is working. Thanks Hal.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@manderson7 care to share any specifics on how you found the data which was unexpected? That might help the next person!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Turns out, that when you ingest a pcap via the Data Inputs/New PCAP section, it's supposed to add the pcap data into the inputs.conf. That's not really covered in the documentation.
Also, and this will seem quite obvious, but make certain you're searching in the correct time period for the data you're looking for :). That's really all that was problematic with our approach.
A feature request I'd look for in the future for this is to be able to search on the name we give the pcap when it's ingested, to make it easier to find when searching. We found yours, Hal, because it had an IP that we weren't using.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dear manderson7,
I have the same problem than you: .pcap file content is copied into inputs.conf. What shall i do in order to be able to search the .pcap content?
Thanks for your explanation.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Narrow down the src and destination IP addresses in the pcap and search on those. That's what I had to do to find my data. Luckily, they were different than the rest of my environment. Also, when you ingest, set the pcap to use system time for easier searching.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
did you manage to find where in splunk the data is kept.
This is driving me mad.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use system time when you're ingesting, so it's easier to search the time that you uploaded. Also, maybe upload to a test index so there's less data to check.
It's not the most intuitive of setups.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, are you following the steps documented here? Does Splunk let you upload the pcap file as it says on this page? If not, what happens? Are you seeing an error message or anything else that does not match the docs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
More questions: what version of splunk and Stream? How large is the pcap? I was able to successfully test this on my local system.
