All Apps and Add-ons

Splunk App for Stream: Why can I only see localhost activity?



I have installed the app Streams on Splunk 6.1.3 with Centos 64, everything looks like the app is working but i can only see the activity of localhost.
I have checked the filters and there isn't any filter.
The TA and the APP are in the same server (indexer).

Anyone knows what could be happening?


Tags (2)

Splunk Employee
Splunk Employee

App for Stream can only see traffic for the network devices available on the same host machine. You may want to try using the <Interface> or <InterfaceRegex> configuration parameters in streamfwd.xml to make sure it's capturing traffic from all of the available devices. See "Use XML Capture element to specify network interfaces" for more information.

0 Karma


Thanks neelamssntosh but the problem is that I would like to that app hear all the traffic not only the one that generate the host.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...