Getting Data In

How to filter input netflow data?

yoan
Explorer


Hello

I am setting up netflow ticket collection on splunk.

I am a very occasional user, and I come to you ask help.

What interests me are specific dialogs of my network infrastructure :

src=net_A to dest=net_B or src=net_B to dest=net_A

All the rest i don't want splunk to keep it and store it, for example net_B to net_B, net_B to net_C, .....

I think I must use CIRDMATCH for my need, to do the filtering I think it must be done on the forwarder but not sure

Is there any possibility of doing this ?

My splunk infrastructure:

splunk 8.1.1 2 Forwarder

2 Indexer
2 Search Head
1 server deployment / license


thank you

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...