All Apps and Add-ons

Splunk App for Stream on local machine

soledger39
New Member

I have Splunk Enterprise 6.5 installed on a dual nic server. Eth0 - management and Eth1 - monitoring (promiscuous mode). How do I point Splunk App for Stream to collect data from eth1 and not Wired Data input?

There seems to be information on how to do this on a remote machine using Universal/Stream Forwarders, but nothing about on a local machine.

Please advise

Tags (1)
0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

add the following config parameter to Splunk_TA_stream/local/streamfwd.conf file:

[streamfwd://streamfwd]
streamfwdcapture.0.interface = eth1

See http://docs.splunk.com/Documentation/StreamApp/6.6.1/DeployStreamApp/ConfigureStreamForwarder#Use_st... for more details

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...