Can cflowd format be Splunked?

[juthsn]

Hello.
A customer is getting external firewall logs from a vendor in "cflowd format".
Can cflowd format be Splunked? If so, any documentation or info re the same would be awesome.

Thanks.

[juthsn]

Hi, let me rephrase then 🙂
Has anybody worked with this format before? We have never seen the raw data in this type of file and are not sure if it is human readable ascii.
Wasn't able to find a sample file either.

Thanks!

[MuS]

After some googling I learned that cflowd is a flow analysis tool that was used for analyzing Cisco's NetFlow enabled switching method So, if it uses netflow you can check out any of the netflow apps https://apps.splunk.com/apps/#/search/netflow/page/1 maybe they can be of help in this case

[MuS · Accepted solution]

Hi juthsn,

the answer is as easy as this:

If this format is human readable: yes, Splunk can index it.
If this format is binary/non-readable by humans: no, Splunk cannot index it.

For the later, you could still use some external conversion script and have the output of this script index by Splunk.

hope this helps ...

cheers, MuS