How can I use Netflow in Splunk when it's on a Windows Box without buying more software?

[Shane]

I'm in the middle of a POC of Splunk and would like to start putting my netflow data into it and be able to graphically represent netflow and even possibly do drill downs like so many programs do. Is this possible and if so how? I saw some stuff that said that I had to install a netflow software but they were all Unix software and I have Splunk on a Windows08/64 server.

[NetFlow_Logic]

NetFlow for Splunk powered by NetFlow Integrator is running on Linux and Windows (as of v3):

http://splunk-base.splunk.com/apps/22328/netflow-for-splunk-powered-by-netflow-integrator

To learn more about NetFlow Integrator please visit https://www.netflowlogic.com/

[dwaddle · Accepted solution]

I don't know about the "buying" part, but Splunk cannot directly digest Netflow data without some additional help. Netflow, in its native form, is a binary format that has to be extracted to plain text by something before Splunk can digest it.

A quick search for "netflow windows" turned up several options for processing Netflow data on a Windows host. Serverfault has this useful answer:

http://serverfault.com/questions/9256/netflow-collector-for-windows-free