Getting Data In
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Anyone bringing NetScout data into Splunk?
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bandit
Motivator
02-10-2016
08:38 AM
Anyone bringing NetScout data into Splunk?
If so, how are you achieving this?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
wbfoxii
Communicator
03-10-2016
06:41 AM
Just this week, we fired up some of our Netflow data, forwarding from a single Netscout collector to a Heavy Forwarder. We knew that the binary data flow was about 30 GB, but when it was expanded to ASCII, it was over 200 GB. It overran our license. We shut it down.
For now, we are planning to gather the new ASR record instead of Netflow. That will sort of integrate our Netflow with the packet data from the Infinistreams into one source.
So before you do this, figure out how much Netflow you have, how much ASCII it will expand into, and how big your license is. Our Splunkers here think that Netflow is something to be very careful about.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
wbfoxii
Communicator
03-10-2016
06:41 AM
Just this week, we fired up some of our Netflow data, forwarding from a single Netscout collector to a Heavy Forwarder. We knew that the binary data flow was about 30 GB, but when it was expanded to ASCII, it was over 200 GB. It overran our license. We shut it down.
For now, we are planning to gather the new ASR record instead of Netflow. That will sort of integrate our Netflow with the packet data from the Infinistreams into one source.
So before you do this, figure out how much Netflow you have, how much ASCII it will expand into, and how big your license is. Our Splunkers here think that Netflow is something to be very careful about.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bandit
Motivator
03-17-2016
08:54 AM
Thanks @wbfoxii
So you are exporting form netflow, then converting from binary to text, then having Splunk agent ingest the text file?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
wbfoxii
Communicator
03-17-2016
09:40 AM
Yep - Using our Netscout collectors to convert the binary, we were then forwarding text data to Splunk.
Get Updates on the Splunk Community!
Dashboards: Hiding charts while search is being executed and other uses for tokens
There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...
Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...
This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...
Brains, Bytes, and Boston: Learn from the Best at .conf25
When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...
