As noted here http://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/UseStreamtoparsePCAPfiles
there are three ways to use Stream to parse PCAP files;
- Upload pcaps in Splunk Web.
- Ingest pcaps using command line options.
- Ingest pcaps using streamfwd.conf.
Splunk Web has a limit in terms of the file size it can accept via HTTP POST. This seems to be a function of Splunk's implementation of CherryPy in Splunk Web, and likely not to be fixed in the near future.
Using the command line to ingest PCAPs into Stream is the most reliable way to accomplish this task for PCAPs of arbitrary size. From the above page:
Read pcap files
Use the -r option to read individual pcap files. For example:
./streamfwd -r my.pcap
Ingest pcap files from a directory
Use the --pcapdir DIR option to monitor and index pcap files in a directory. For example:
./streamfwd --pcapdir ~/test_pcap_dir --afteringest repeat
You can run these on the search head (if the App for Stream is installed there), or on an arbitrary machine hosting the Stream Forwarder.
