All Apps and Add-ons

Streams targeted packet capture for Windows

torowa
Path Finder

Hi Splunkers.

In the Configuring Streams manual, it outlines configuring Splunk_TA_stream to point to an NFS server in the streamfwd stanza on the UF.
i.e.:

[streamfwd]
fileServerId = nfs://192.168.6.1/packetcaptures
fileServerMountPoint = /usr/local/packetcaptures

The manual doesn't specifically mention a separate approach for Windows (which wouldn't normally have any NFS support installed).

What's the approach people are taking in mixed Windows/Linux UF invironments?
Is further config needed beyond the stanza above on Windows endpoints to get the captured packets onto the remote fileserver.
For example, does NFS support need to be installed separately on each of the Windows endpoints to be able to use target packet capture on them?

Streams would be deployed via a deployment server, so looking to avoid any manual install/config actions across the fleet.

Thanks.

0 Karma
1 Solution

torowa
Path Finder

Answering my own question here.
After spending some more time tinkering I realised that the fileserver mountpoint is only relevant to the SH (or whatever device the flows are being forwarded to for indexing) so not needed on the UFs.

View solution in original post

0 Karma

torowa
Path Finder

Answering my own question here.
After spending some more time tinkering I realised that the fileserver mountpoint is only relevant to the SH (or whatever device the flows are being forwarded to for indexing) so not needed on the UFs.

0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...