Getting Data In

Anyone bringing NetScout data into Splunk?

bandit
Motivator

Anyone bringing NetScout data into Splunk?
If so, how are you achieving this?

0 Karma
1 Solution

wbfoxii
Communicator

Just this week, we fired up some of our Netflow data, forwarding from a single Netscout collector to a Heavy Forwarder. We knew that the binary data flow was about 30 GB, but when it was expanded to ASCII, it was over 200 GB. It overran our license. We shut it down.

For now, we are planning to gather the new ASR record instead of Netflow. That will sort of integrate our Netflow with the packet data from the Infinistreams into one source.

So before you do this, figure out how much Netflow you have, how much ASCII it will expand into, and how big your license is. Our Splunkers here think that Netflow is something to be very careful about.

View solution in original post

wbfoxii
Communicator

Just this week, we fired up some of our Netflow data, forwarding from a single Netscout collector to a Heavy Forwarder. We knew that the binary data flow was about 30 GB, but when it was expanded to ASCII, it was over 200 GB. It overran our license. We shut it down.

For now, we are planning to gather the new ASR record instead of Netflow. That will sort of integrate our Netflow with the packet data from the Infinistreams into one source.

So before you do this, figure out how much Netflow you have, how much ASCII it will expand into, and how big your license is. Our Splunkers here think that Netflow is something to be very careful about.

bandit
Motivator

Thanks @wbfoxii

So you are exporting form netflow, then converting from binary to text, then having Splunk agent ingest the text file?

0 Karma

wbfoxii
Communicator

Yep - Using our Netscout collectors to convert the binary, we were then forwarding text data to Splunk.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...