Getting Data In

In the netflow streaming app, why am I unable to see the netflow data?

New Member

Hi There, I've configured the stream app and streamfwd.log as follow:

netflowReceiver.0.ip = 192.168.1.2
netflowReceiver.0.port = 9996
netflowReceiver.0.protocol = udp
netflowReceiver.0.decoder = netflow

UDP Netflow is coming in on the splunk server, confirmed with TCPDUMP

However, I don't get the netflow data and see these kinds of errors in streamfwd.log:

Caught exception in openDatagramListenersystem:99 bind
Unable to start any Netflow Receivers

Input.conf Local:

Local:

[streamfwd://streamfwd]
splunk_stream_app_location = http://localhost:8000/en-us/custom/splunk_app_stream/
stream_forwarder_id =
disabled = 0

Default:

[streamfwd]
disabled = true
0 Karma

SplunkTrust
SplunkTrust

@heskez, this seems same as your previous question https://answers.splunk.com/answers/626502/stream-app-netflowreceiver-problem.html

Please confirm. If these are the same then you would need to add detail to your previous question itself.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

New Member

It's the same yes. But this one has a better overview.

0 Karma