How can I index Netflow?

[Dan]

I want to be able to search netflow data to find suspicious conversations (i.e. someone opening a connection and closing it right away). Is there a way to get a netflow feed into Splunk?

[NetFlow_Logic]

All previously existing versions of NetFlow Logic Splunk apps have been merged into one NetFlow for Splunk by NetFlow Logic App. See this link http://apps.splunk.com/app/489/

[maverick]

Netflow data is binary and, even though you could splunk it like that, it would not be useful in that form inside your Splunk GUI while searching. Therefore, the flow will need to be converted to humanly-readable text first via some NetFlow-2-Text converter, such as the ones mentioned at the "TrafficFlows" link provided in the previous answer.

Once converted to text, however, you could then easily setup Splunk to listen on any open tcp or udp port for incoming converted flow streams and just send the it directly to that port and SPlunk will index it in real time.

[NetFlow_Logic]

"Splunk for NetFlow" App is replaced with "NetFlow for Splunk". See this link: http://splunk-base.splunk.com/apps/22328/netflow-for-splunk-powered-by-netflow-integrator

[maverick]

See this link for the Splunk for Netflow App: http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+for+NetFlow

[rayfoo]

Yes.

http://www.splunk.com/wiki/Apps:TrafficFlows