All Apps and Add-ons

streamfwd 8.1.5 doesn't parse netflow (bytes_in, bytes_out, packets_in, packets_out) always 0

Kim
Explorer

Hello, colleagues.

After upgrading Splunk Stream 8.1.5 stopped parsing bytes_in, bytes_out, packets_in, packets_out, they are always equal to zero... 
{ [-]
app_tag: PANA-L7-PEN : xxxxxxxxxxxxx
bytes_in: 0
bytes_out: 0
dest_ip: x.x.x.x
dest_port: xxx
endtime: 2025-05-28T15:01:26Z
event_name: netFlowData
exporter_ip: x.x.x.x
exporter_time: 2025-May-28 15:01:26
exporter_uptime: 3148584010
flow_end_reason: 3
flow_end_rel: 0
flow_start_rel: 0
fwd_status: xx
input_snmpidx: xx
netflow_elements: [ [+]
]
netflow_version: 9
observation_domain_id: 1
output_snmpidx: xxx
packets_in: 0
packets_out: 0
protoid: 6
selector_id: 0
seqnumber: 2278842767
src_ip: x.x.x.x
src_port: 9997
timestamp: 2025-05-28T15:01:26Z
tos: 0
}

I am using an independent streamforwarder with streamfwd installed as a service on linux ubuntu 22.04.5
If I stop the service and replace the streamfwd file with the old version 8.1.3 and start the service again, everything is ok

Anybody run into this? 

Thanks!

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...