Deployment Architecture

Ingest Netflow Data using Windows, Linux, Cisco Netflow

Blackmagician
Engager

I would like some advice on what is the best way to implement the following solution.

I would like to get netflow data to Splunk Enterprise running on Windows server that is coming from cisco devices using netflow-exporter.

The problem is windows has a winpcap vulnerability and I would rather not use any add ons that contain that wpcap.dll.

My solution would be to set up a Linux server to use the universal forwarder to ingest the netflow data and parse that to Splunk enterprise on Windows without any add ons.

I am having a hard timevdetermining if this is possible or will I require a TA on Splunk enterprise?

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...