All Apps and Add-ons

What does the "cancelled" attribute donate when capturing TCP flows using Stream App?

twigat
Engager

Hi Everyone,

I have a question regarding the fields returned by Splunk App for Stream. I've configured a number of TCP flow monitors and I see some flows have a "cancelled" attribute.

I couldn't find any documentation about what this field's purpose is, could this be that an RST was sent instead of a FIN|FIN/ACK for a TCP flow? Any other definitions I'm not considering?

0 Karma
1 Solution

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hi,

You're correct - "cancelled" means that the flow was terminated with an RST.

As for where to get the documentation - if you go to the Configuration -> Configure Streams page inside the App for Stream UI and click on a stream, you'll see a list of fields you can enable/disable/etc. Each field there has a description column that provides some info about the field.

View solution in original post

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hi,

You're correct - "cancelled" means that the flow was terminated with an RST.

As for where to get the documentation - if you go to the Configuration -> Configure Streams page inside the App for Stream UI and click on a stream, you'll see a list of fields you can enable/disable/etc. Each field there has a description column that provides some info about the field.

Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...