All Apps and Add-ons

Splunk App for Stream: Why can I only see localhost activity?

jmallorquin
Builder

Hi,

I have installed the app Streams on Splunk 6.1.3 with Centos 64, everything looks like the app is working but i can only see the activity of localhost.
I have checked the filters and there isn't any filter.
The TA and the APP are in the same server (indexer).

Anyone knows what could be happening?

Thanks,

Tags (2)

mdickey_splunk
Splunk Employee
Splunk Employee

App for Stream can only see traffic for the network devices available on the same host machine. You may want to try using the <Interface> or <InterfaceRegex> configuration parameters in streamfwd.xml to make sure it's capturing traffic from all of the available devices. See "Use XML Capture element to specify network interfaces" for more information.

0 Karma

jmallorquin
Builder

Thanks neelamssntosh but the problem is that I would like to that app hear all the traffic not only the one that generate the host.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...