Getting Data In

Can cflowd format be Splunked?

Engager

Hello.
A customer is getting external firewall logs from a vendor in "cflowd format".
Can cflowd format be Splunked? If so, any documentation or info re the same would be awesome.

Thanks.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi juthsn,

the answer is as easy as this:

If this format is human readable: yes, Splunk can index it.
If this format is binary/non-readable by humans: no, Splunk cannot index it.

For the later, you could still use some external conversion script and have the output of this script index by Splunk.

hope this helps ...

cheers, MuS

View solution in original post

Engager

Hi, let me rephrase then 🙂
Has anybody worked with this format before? We have never seen the raw data in this type of file and are not sure if it is human readable ascii.
Wasn't able to find a sample file either.

Thanks!

0 Karma

SplunkTrust
SplunkTrust

After some googling I learned that cflowd is a flow analysis tool that was used for analyzing Cisco's NetFlow enabled switching method So, if it uses netflow you can check out any of the netflow apps https://apps.splunk.com/apps/#/search/netflow/page/1 maybe they can be of help in this case

0 Karma

SplunkTrust
SplunkTrust

Hi juthsn,

the answer is as easy as this:

If this format is human readable: yes, Splunk can index it.
If this format is binary/non-readable by humans: no, Splunk cannot index it.

For the later, you could still use some external conversion script and have the output of this script index by Splunk.

hope this helps ...

cheers, MuS

View solution in original post