Getting Data In
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

How to forward Netflow data using Stream addon on UF to Indexers on port 9997 ?

dm1
Contributor
‎07-13-2021 05:55 PM

I am looking to collect Netflow data on a host, where I have installed Splunk UF along with Stream addon.

I want to send this data to a client's Splunk Indexer,  on port 9997.

While the doc states, configure indexer to receive Stream data on port 9997, however, in the "Set up data collection on remote machines" section, it requires HEC tokens for the indexer.

Is there a way to configure the addon to to Netflow data to Indexers on port 9997 instead of on the HEC token ?

0 Karma
Reply
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...