Getting Data In

How to ingest netflow/sflow logs

hkumar26
New Member

We intend to collected netflow/sflow logs in our Splunk Enterprise solution. I read that there is an app required to collect logs. Also I came across splunk docs to configure flow collector- https://docs.splunk.com/Documentation/StreamApp/7.1.0/DeployStreamApp/ConfigureFlowcollector

This link doesn't mention about app. Do I need the app or the process mention in docs? which is recommended method?

Thanks,

0 Karma
1 Solution

maraman_splunk
Splunk Employee
Splunk Employee

there are several possibilities for it with pro/con each time
if you go the stream way, just install the stream app following the docs and configure it to collect your network data directly. (ie your network device will send them to stream)
for the collection part, it can be a UF with stream TA (probably easier to start with) or a streamfwd

if you go the TA way without stream, the splunk TA for netflow include a collector for netflow , which will make the conversion to log files before data being injected into splunk (so the future is probably to go the stream way)

or there's another third party TA including a collector on splunkbase, altough you'll probably need a specific license for it.

so look to all solutions, tests and choose the one that best fit your needs

Hope that helps.

View solution in original post

0 Karma

maraman_splunk
Splunk Employee
Splunk Employee

there are several possibilities for it with pro/con each time
if you go the stream way, just install the stream app following the docs and configure it to collect your network data directly. (ie your network device will send them to stream)
for the collection part, it can be a UF with stream TA (probably easier to start with) or a streamfwd

if you go the TA way without stream, the splunk TA for netflow include a collector for netflow , which will make the conversion to log files before data being injected into splunk (so the future is probably to go the stream way)

or there's another third party TA including a collector on splunkbase, altough you'll probably need a specific license for it.

so look to all solutions, tests and choose the one that best fit your needs

Hope that helps.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...