How to ingest netflow/sflow logs

[hkumar26]

We intend to collected netflow/sflow logs in our Splunk Enterprise solution. I read that there is an app required to collect logs. Also I came across splunk docs to configure flow collector- https://docs.splunk.com/Documentation/StreamApp/7.1.0/DeployStreamApp/ConfigureFlowcollector

This link doesn't mention about app. Do I need the app or the process mention in docs? which is recommended method?

Thanks,

[maraman_splunk · Accepted solution]

there are several possibilities for it with pro/con each time
if you go the stream way, just install the stream app following the docs and configure it to collect your network data directly. (ie your network device will send them to stream)
for the collection part, it can be a UF with stream TA (probably easier to start with) or a streamfwd

if you go the TA way without stream, the splunk TA for netflow include a collector for netflow , which will make the conversion to log files before data being injected into splunk (so the future is probably to go the stream way)

or there's another third party TA including a collector on splunkbase, altough you'll probably need a specific license for it.

so look to all solutions, tests and choose the one that best fit your needs

Hope that helps.