All Apps and Add-ons

Running Stream against old PCAPS

w0lverineNOP
Path Finder

I am trying to run Stream against a few old pcaps. My set up includes the following:
Created a index that is pointing to an uploaded file of old pcaps had the Stream Forwarder pointed to the index
I have my host ip address added to the whitelist and is still being caught and indexed.

Any suggestions?

Tags (2)
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

Per the doc, you can edit the streamfwd.xml file:

Example 4: Use pcap file instead of network interface
You can also use a previously generated pcap file instead of an actual network interface, using this variation of the element.

<Interface>/tmp/data.cap</Interface>
<Offline>true</Offline>
<Filter>tcp port 80</Filter>
<Repeat>true</Repeat>
<SysTime>true</SysTime>
<BitsPerSecond>10000000</BitsPerSecond>

Should be set to the path of your pcap file
True means use pcap, false means is a network device name
True means to play back the pcap file repeatedly for continuous load
True means to use the system time for packet timestamps
Rate limiter, defaults to 10 Mbps if undefined and is true

http://docs.splunk.com/Documentation/StreamApp/6.1.1/DeployStreamApp/ConfigureStreamForwarder

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

Per the doc, you can edit the streamfwd.xml file:

Example 4: Use pcap file instead of network interface
You can also use a previously generated pcap file instead of an actual network interface, using this variation of the element.

<Interface>/tmp/data.cap</Interface>
<Offline>true</Offline>
<Filter>tcp port 80</Filter>
<Repeat>true</Repeat>
<SysTime>true</SysTime>
<BitsPerSecond>10000000</BitsPerSecond>

Should be set to the path of your pcap file
True means use pcap, false means is a network device name
True means to play back the pcap file repeatedly for continuous load
True means to use the system time for packet timestamps
Rate limiter, defaults to 10 Mbps if undefined and is true

http://docs.splunk.com/Documentation/StreamApp/6.1.1/DeployStreamApp/ConfigureStreamForwarder

w0lverineNOP
Path Finder

Thank you!!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...