Why is the Splunk App for Stream 6.4.1 unable to see HTTP stream data?

[todd_miller]

Running Splunk 6.3.1 and Splunk App for Stream 6.4.1. I have a Linux box running the Stream TA. This box is pulling data on an interface connected to a tap. A tcpdump on the box is showing HTTP traffic, however, I'm not seeing any HTTP streams in the Splunk App for Stream. I have no filters configured so I'm assuming it should be collecting all network data. I can confirm that I'm seeing various other data being ingested into my instance: DNS, SMB, TCP, UDP, etc. I'm also seeing TCP data destined for port 80.

Why would the Splunk App for Stream be unable to see the HTTP data?

[vshcherbakov_sp]

hi todd_miller,

A couple of things to check:
- make sure that HTTP-based streams - http, Splunk_HTTP*, your custom HTTP streams (if any) are created and enabled in the App For Stream UI->Configuration->Configure Streams
- check that these streams are configured for the stream forwarder group(s) your Stream TA belongs to ( Configuration -> Distributed Forwarder Management)

[todd_miller]

Sorry this took so long to get back to you.

I did check that all streams relating to HTTP are enabled and I also checked to make sure that the streams are configured for the stream forwarder groups.

This is a very simple config of one stream forwarder sending all stream traffic to my splunk server.

I also verified that traffic destined to port 80 is being indexed. The application is listed as "Unknown".

[vshcherbakov_sp]

If the traffic is being indexed as "Unknown" (app="unknown", correct?) it looks like Stream fails to classify it as HTTP, which is kind of odd... Is your traffic by any chance HTTP/2, or encrypted with SSL/TLS, or somehow encapsulated? Would you be able to open a support case and supply a sample tcpdump capture of it?