All Apps and Add-ons

Streams targeted packet capture for Windows

torowa
Path Finder

Hi Splunkers.

In the Configuring Streams manual, it outlines configuring Splunk_TA_stream to point to an NFS server in the streamfwd stanza on the UF.
i.e.:

[streamfwd]
fileServerId = nfs://192.168.6.1/packetcaptures
fileServerMountPoint = /usr/local/packetcaptures

The manual doesn't specifically mention a separate approach for Windows (which wouldn't normally have any NFS support installed).

What's the approach people are taking in mixed Windows/Linux UF invironments?
Is further config needed beyond the stanza above on Windows endpoints to get the captured packets onto the remote fileserver.
For example, does NFS support need to be installed separately on each of the Windows endpoints to be able to use target packet capture on them?

Streams would be deployed via a deployment server, so looking to avoid any manual install/config actions across the fleet.

Thanks.

0 Karma
1 Solution

torowa
Path Finder

Answering my own question here.
After spending some more time tinkering I realised that the fileserver mountpoint is only relevant to the SH (or whatever device the flows are being forwarded to for indexing) so not needed on the UFs.

View solution in original post

0 Karma

torowa
Path Finder

Answering my own question here.
After spending some more time tinkering I realised that the fileserver mountpoint is only relevant to the SH (or whatever device the flows are being forwarded to for indexing) so not needed on the UFs.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...