All Apps and Add-ons

Splunk Stream is not capture interfaces



I install stream-app on Splunk Search-Head and deploy independent Stream forwarder via "curl -sSL http://stream-cont-func02:8000/en-us/custom/splunk_app_stream/install_streamfwd | sudo bash" command. I enabled HEC. I check the stream-app GUI, server status is active and send metadata.

I mirror the traffic from switch to server interface and check the interface via tcpdump command. I see the traffics are mirrored. But I can not see the traffics int the splunk stream app. Splunk says normally splunk streamfwd capture all network interfaces.

What can I do?

Best Regards

Thank you

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!