All Apps and Add-ons

Stream app - Netflowreceiver problem

heskez
Engager

Hi There, I've configured the stream app and streamfwd.log as follow:

netflowReceiver.0.ip = 192.168.1.2
netflowReceiver.0.port = 9996
netflowReceiver.0.protocol = udp
netflowReceiver.0.decoder = netflow

UDP Netflow is coming in on the splunk server, confirmed with TCPDUMP

However, I don't get the netflow data and see these kinds of errors in streamfwd.log:

Caught exception in openDatagramListenersystem:99 bind
Unable to start any Netflow Receivers

Tags (1)
0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

Ok so try a different port number (just as a test obviously)
netstat -anp | grep 9996 should show you which process is already in use, based on your previous post:
udp 0 0 0.0.0.0:9996 0.0.0.0: 12482/nfcapd

If you ps -ef | grep 12482
You will get some more detail

What is nfcapd? I googled it and it advises it is already capturing network traffic for stream...you will either need to switch port on the stream receiver or stop nfcapd to run the stream on port 9996

View solution in original post

0 Karma

p_gurav
Champion

Can you provide inputs.conf ?

0 Karma

heskez
Engager

Local:

[streamfwd://streamfwd]
splunk_stream_app_location = http://localhost:8000/en-us/custom/splunk_app_stream/
stream_forwarder_id =
disabled = 0

Default:

[streamfwd]
disabled = true

0 Karma

heskez
Engager

Is this inputs.conf sufficient to proceed?

0 Karma

Cliff-M
Engager

@heskez Hello there,

I am having this same issue (stream.NetflowReceiver - NetFlowDecoder::decodeFlow Unable to decode flow set data. No template with id 5206) were you able to get this resolved? If so, how did you fix it? I've searched for documentation and not specific to this problem.

Thanks

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...