All Apps and Add-ons

Running Stream against old PCAPS

w0lverineNOP
Path Finder

I am trying to run Stream against a few old pcaps. My set up includes the following:
Created a index that is pointing to an uploaded file of old pcaps had the Stream Forwarder pointed to the index
I have my host ip address added to the whitelist and is still being caught and indexed.

Any suggestions?

Tags (2)
1 Solution

rphillips_splun
Splunk Employee
Splunk Employee

Per the doc, you can edit the streamfwd.xml file:

Example 4: Use pcap file instead of network interface
You can also use a previously generated pcap file instead of an actual network interface, using this variation of the element.

<Interface>/tmp/data.cap</Interface>
<Offline>true</Offline>
<Filter>tcp port 80</Filter>
<Repeat>true</Repeat>
<SysTime>true</SysTime>
<BitsPerSecond>10000000</BitsPerSecond>

Should be set to the path of your pcap file
True means use pcap, false means is a network device name
True means to play back the pcap file repeatedly for continuous load
True means to use the system time for packet timestamps
Rate limiter, defaults to 10 Mbps if undefined and is true

http://docs.splunk.com/Documentation/StreamApp/6.1.1/DeployStreamApp/ConfigureStreamForwarder

View solution in original post

rphillips_splun
Splunk Employee
Splunk Employee

Per the doc, you can edit the streamfwd.xml file:

Example 4: Use pcap file instead of network interface
You can also use a previously generated pcap file instead of an actual network interface, using this variation of the element.

<Interface>/tmp/data.cap</Interface>
<Offline>true</Offline>
<Filter>tcp port 80</Filter>
<Repeat>true</Repeat>
<SysTime>true</SysTime>
<BitsPerSecond>10000000</BitsPerSecond>

Should be set to the path of your pcap file
True means use pcap, false means is a network device name
True means to play back the pcap file repeatedly for continuous load
True means to use the system time for packet timestamps
Rate limiter, defaults to 10 Mbps if undefined and is true

http://docs.splunk.com/Documentation/StreamApp/6.1.1/DeployStreamApp/ConfigureStreamForwarder

View solution in original post

w0lverineNOP
Path Finder

Thank you!!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.