Getting Data In

How to configure nfdump to convert Netflow data from binary to text or csv?

Splunk Employee
Splunk Employee

I need to convert netflow data from binary to text or csv so that it can be splunked. I have downloaded nfdump and was looking for any information on how to configure it?

Also, is there a better free tool then nfdump

Thanks,

Todd

Tags (1)
2 Solutions

Contributor

Did you get it up and let it capture flows and writing it to disk? On http://nfdump.sourceforge.net/ are the fundamentals. So after download, untar, ./configure , make , make install ( and some dependecies like gcc, flex and others its there)

to get the deamon up : nfcapd -w -D -l /flow_base_dir/router1 -p 23456

so a port per flow,,,you should then have the rolling binaries in the /flow_base_dir/router1

But then comes the part which I am doubting as well, cause with nfdump you can convert the binaries to stdout in ascii and to a file as,,,,binary

So it looks like you have to redirect nfdump "command for doing reversing dirs" >> file and splunk that but how to prevent dups here?

OR use scripted input,,,I am hoping that someone has been so far.

anyone?

Cheers

View solution in original post

Splunk Employee
Splunk Employee

Splunk Employee
Splunk Employee

Contributor

Did you get it up and let it capture flows and writing it to disk? On http://nfdump.sourceforge.net/ are the fundamentals. So after download, untar, ./configure , make , make install ( and some dependecies like gcc, flex and others its there)

to get the deamon up : nfcapd -w -D -l /flow_base_dir/router1 -p 23456

so a port per flow,,,you should then have the rolling binaries in the /flow_base_dir/router1

But then comes the part which I am doubting as well, cause with nfdump you can convert the binaries to stdout in ascii and to a file as,,,,binary

So it looks like you have to redirect nfdump "command for doing reversing dirs" >> file and splunk that but how to prevent dups here?

OR use scripted input,,,I am hoping that someone has been so far.

anyone?

Cheers

View solution in original post