Getting Data In

How to configure nfdump to convert Netflow data from binary to text or csv?

tgow
Splunk Employee
Splunk Employee

I need to convert netflow data from binary to text or csv so that it can be splunked. I have downloaded nfdump and was looking for any information on how to configure it?

Also, is there a better free tool then nfdump

Thanks,

Todd

Tags (1)
2 Solutions

Starlette
Contributor

Did you get it up and let it capture flows and writing it to disk? On http://nfdump.sourceforge.net/ are the fundamentals. So after download, untar, ./configure , make , make install ( and some dependecies like gcc, flex and others its there)

to get the deamon up : nfcapd -w -D -l /flow_base_dir/router1 -p 23456

so a port per flow,,,you should then have the rolling binaries in the /flow_base_dir/router1

But then comes the part which I am doubting as well, cause with nfdump you can convert the binaries to stdout in ascii and to a file as,,,,binary

So it looks like you have to redirect nfdump "command for doing reversing dirs" >> file and splunk that but how to prevent dups here?

OR use scripted input,,,I am hoping that someone has been so far.

anyone?

Cheers

View solution in original post

araitz
Splunk Employee
Splunk Employee

Starlette
Contributor

Did you get it up and let it capture flows and writing it to disk? On http://nfdump.sourceforge.net/ are the fundamentals. So after download, untar, ./configure , make , make install ( and some dependecies like gcc, flex and others its there)

to get the deamon up : nfcapd -w -D -l /flow_base_dir/router1 -p 23456

so a port per flow,,,you should then have the rolling binaries in the /flow_base_dir/router1

But then comes the part which I am doubting as well, cause with nfdump you can convert the binaries to stdout in ascii and to a file as,,,,binary

So it looks like you have to redirect nfdump "command for doing reversing dirs" >> file and splunk that but how to prevent dups here?

OR use scripted input,,,I am hoping that someone has been so far.

anyone?

Cheers

Get Updates on the Splunk Community!

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...