Solved: Re: Stream app - Netflowreceiver problem - Page 2

heskez · ‎03-14-2018

Hi There, I've configured the stream app and streamfwd.log as follow:

netflowReceiver.0.ip = 192.168.1.2
netflowReceiver.0.port = 9996
netflowReceiver.0.protocol = udp
netflowReceiver.0.decoder = netflow

UDP Netflow is coming in on the splunk server, confirmed with TCPDUMP

However, I don't get the netflow data and see these kinds of errors in streamfwd.log:

Caught exception in openDatagramListenersystem:99 bind
Unable to start any Netflow Receivers

gjanders · ‎03-22-2018

Ok so try a different port number (just as a test obviously)
netstat -anp | grep 9996 should show you which process is already in use, based on your previous post:
udp 0 0 0.0.0.0:9996 0.0.0.0: 12482/nfcapd

If you ps -ef | grep 12482
You will get some more detail

What is nfcapd? I googled it and it advises it is already capturing network traffic for stream...you will either need to switch port on the stream receiver or stop nfcapd to run the stream on port 9996

-
Alerts for Splunk Admins, Version Control for Splunk, Decrypt2 VersionControl For SplunkCloud

View solution in original post

p_gurav · ‎03-14-2018

Can you provide inputs.conf ?

heskez · ‎03-14-2018

Local:

[streamfwd://streamfwd]
splunk_stream_app_location = http://localhost:8000/en-us/custom/splunk_app_stream/
stream_forwarder_id =
disabled = 0

Default:

[streamfwd]
disabled = true

heskez · ‎03-15-2018

Is this inputs.conf sufficient to proceed?

Cliff-M · ‎12-15-2023

@heskez Hello there,

I am having this same issue (stream.NetflowReceiver - NetFlowDecoder::decodeFlow Unable to decode flow set data. No template with id 5206) were you able to get this resolved? If so, how did you fix it? I've searched for documentation and not specific to this problem.

Thanks

Stream app - Netflowreceiver problem

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Analytics Workspace deprecation

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Join the Conversation