All Apps and Add-ons

When uploading pcap data to be ingested by splunk stream, where does that data go?

dan_ritter
Engager

I am trying to get Splunk Stream to ingest some pcap files. I cannot seem to find the data once I follow the instructions on the documentation(https://docs.splunk.com/Documentation/StreamApp/7.1.1/DeployStreamApp/UseStreamtoparsePCAPfiles)

When I upload through the web UI, I do see the data in the splunk stream app inputs.conf, but I cannot see that data in the UI. If I upload through streamfwd (on the same machine splunk is installed on), it says it has finished, but I still see nothing. I DO have the modular input enabled, and I DO see events from the host itself.

Is there any obvious step I am missing?

0 Karma

micahkemp
Champion

Edit: I just tried uploading a pcap to stream, and unfortunately it seems to set source to whatever stream usually uses for the source, not the pcap filename.

The only solution I can think of for you is to select "More Settings" from the "Add Data" page and give your uploaded data a different host name (in the "host field value" line). This is less than idea, in my opinion, but at least setting it for a test should show you the data you just added.

Original answer:

Have you looked in the index the rest of the stream data goes into, and for all time? I'm assuming the pcap input for stream will use the timestamps from the pcap itself for the event times, so you may need to expand your search time.

You may try this search for all time to see if you can identify a source that looks to maybe be for your imported pcap:

| tstats count WHERE index=* sourcetype=stream* BY index source

And if one of those sources looks like it may be your uploaded data, search like this to see it:

index=<index from above search> sourcetype=<sourcetype from above source>
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...