All Apps and Add-ons

Splunk App for Stream: Why can I only see localhost activity?

jmallorquin
Builder

Hi,

I have installed the app Streams on Splunk 6.1.3 with Centos 64, everything looks like the app is working but i can only see the activity of localhost.
I have checked the filters and there isn't any filter.
The TA and the APP are in the same server (indexer).

Anyone knows what could be happening?

Thanks,

Tags (2)

mdickey_splunk
Splunk Employee
Splunk Employee

App for Stream can only see traffic for the network devices available on the same host machine. You may want to try using the <Interface> or <InterfaceRegex> configuration parameters in streamfwd.xml to make sure it's capturing traffic from all of the available devices. See "Use XML Capture element to specify network interfaces" for more information.

0 Karma

jmallorquin
Builder

Thanks neelamssntosh but the problem is that I would like to that app hear all the traffic not only the one that generate the host.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...