Question on Environment variable and PCAP File Location setup,Question about PCAP File location path and Environment Variable

[ngwailam]

I am struggled in importing the pcap file for indexing.
Here is my setup:
- Win 10 Splunk
- PCAP Analyzer for Splunk Version 4.1.10

Environment Variable:
Got confused whether to set Variable as:
$SPLUNK_HOME / SPLUNK_HOME
I am current setting both to point to default installation location C:/Program Files/Splunk

File Location path:
Here should I type in a full path of the folder that contains my pcap?
Example:
If my pcap store in this directory : C:\pcap\networktraffic.pcap
Then I should type in C:\pcap\ ?
^That's my current setup

Or the Application run on its own directory which means I have to put my pcap in
C:\Program Files\Splunk\etc\apps\SplunkForPCAP\pcap\
Something like this?

Please help,I am struggled in importing the pcap file for indexing.
Here is my setup:
- Win 10 Splunk
- PCAP Analyzer for Splunk Version 4.1.10

Environment Variable:
Got confused whether to set Variable as:
$SPLUNK_HOME / SPLUNK_HOME
I am current setting both to point to default installation location C:/Program Files/Splunk

File Location path:
Here should I type in a full path of the folder that contains my pcap?
Example:
If my pcap store in this directory : C:\pcap\networktraffic.pcap
Then I should type in C:\pcap\networktraffic.pcap?

Or the Application run on its own directory which mean I have to put my pcap in
C:\Program Files\Splunk\etc\apps\SplunkForPCAP\pcap\
Something like this?

Please help

[rechteklebe]

Hi, have you already checked out the following page?:
https://schwartzdaniel.com/pcap-analyzer-for-splunk-getting-started/
Let me know if it helps.