All Apps and Add-ons

Streams targeted packet capture for Windows

torowa
Explorer

Hi Splunkers.

In the Configuring Streams manual, it outlines configuring Splunk_TA_stream to point to an NFS server in the streamfwd stanza on the UF.
i.e.:

[streamfwd]
fileServerId = nfs://192.168.6.1/packetcaptures
fileServerMountPoint = /usr/local/packetcaptures

The manual doesn't specifically mention a separate approach for Windows (which wouldn't normally have any NFS support installed).

What's the approach people are taking in mixed Windows/Linux UF invironments?
Is further config needed beyond the stanza above on Windows endpoints to get the captured packets onto the remote fileserver.
For example, does NFS support need to be installed separately on each of the Windows endpoints to be able to use target packet capture on them?

Streams would be deployed via a deployment server, so looking to avoid any manual install/config actions across the fleet.

Thanks.

0 Karma
1 Solution

torowa
Explorer

Answering my own question here.
After spending some more time tinkering I realised that the fileserver mountpoint is only relevant to the SH (or whatever device the flows are being forwarded to for indexing) so not needed on the UFs.

View solution in original post

0 Karma

torowa
Explorer

Answering my own question here.
After spending some more time tinkering I realised that the fileserver mountpoint is only relevant to the SH (or whatever device the flows are being forwarded to for indexing) so not needed on the UFs.

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!