All Apps and Add-ons

Streams targeted packet capture for Windows

torowa
Path Finder

Hi Splunkers.

In the Configuring Streams manual, it outlines configuring Splunk_TA_stream to point to an NFS server in the streamfwd stanza on the UF.
i.e.:

[streamfwd]
fileServerId = nfs://192.168.6.1/packetcaptures
fileServerMountPoint = /usr/local/packetcaptures

The manual doesn't specifically mention a separate approach for Windows (which wouldn't normally have any NFS support installed).

What's the approach people are taking in mixed Windows/Linux UF invironments?
Is further config needed beyond the stanza above on Windows endpoints to get the captured packets onto the remote fileserver.
For example, does NFS support need to be installed separately on each of the Windows endpoints to be able to use target packet capture on them?

Streams would be deployed via a deployment server, so looking to avoid any manual install/config actions across the fleet.

Thanks.

0 Karma
1 Solution

torowa
Path Finder

Answering my own question here.
After spending some more time tinkering I realised that the fileserver mountpoint is only relevant to the SH (or whatever device the flows are being forwarded to for indexing) so not needed on the UFs.

View solution in original post

0 Karma

torowa
Path Finder

Answering my own question here.
After spending some more time tinkering I realised that the fileserver mountpoint is only relevant to the SH (or whatever device the flows are being forwarded to for indexing) so not needed on the UFs.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...