Getting Data In

How to filter input netflow data?

yoan
Explorer


Hello

I am setting up netflow ticket collection on splunk.

I am a very occasional user, and I come to you ask help.

What interests me are specific dialogs of my network infrastructure :

src=net_A to dest=net_B or src=net_B to dest=net_A

All the rest i don't want splunk to keep it and store it, for example net_B to net_B, net_B to net_C, .....

I think I must use CIRDMATCH for my need, to do the filtering I think it must be done on the forwarder but not sure

Is there any possibility of doing this ?

My splunk infrastructure:

splunk 8.1.1 2 Forwarder

2 Indexer
2 Search Head
1 server deployment / license


thank you

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...