How do I capture and index these TCP events in Splunk?

[lavkush]

Hello Team,

Would be great to know how do I capture the following alerts in Splunk.

1) TCP Connect Request
2) TCP Disconnect Request
3) TCP Connect Confirm
4) TCP Disconnect Confirm

I need to sniff the local network and capture these in Splunk.
Please direct us to the appropriate portal/page.

Regards,
Ravi.

[skoelpin]

You can set up the stanza in your inputs.conf to capture the TCP traffic. You can tie the request/response together using a transaction command which will alert if there's no response to the request

http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Monitornetworkports