Getting Data In

Indexing a NetFlow logic - log file.

chimbudp
Contributor

I have configured the inputs.conf to monitor the log file of NetFlow logic
Since the log file is in unreadable format , i set the props.conf to NO_BINARY_CHECK =1

After that i receive the logs in the below format . Is this the correct one ? am i missing something here ?

2014-01-29T05:56:35+00:00 10.0.255.245
\x84R\xE8\x98%\x00d\xD2I\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
\xA6\xA3\x00{\x00\x00\x96\x00\x00
: \x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00\xCC\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
"\xB3\xDE\x00\x00\x96\x00\x00
\x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00-\x00\x00\x00\x00\x00\x00\x00 \xAC
\xAC
\xB3\xDE"\x00\x00\xC6\x00\x00
\x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00\x00\xA4\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
"\xB3\xDD\x00\x00\x96\x00\x00
\x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00\xB0\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC

Ayn
Legend

Without knowing the exact format of the file - if the file is in a binary format, you shouldn't be pointing Splunk to read it directly. Splunk has no magic "decoding" of binary files, it indexes what it gets as-is. All you achieve by setting NO_BINARY_CHECK is to force Splunk to read all that non-readable data even though it doesn't make sense to do so.

What you need is something that will decode this data from the binary format to a textual representation of it, and then have Splunk read that output instead. Again, I don't know the exact format of this file that you're referring to, but some kind of flow reader would do this.

MuS
SplunkTrust
SplunkTrust

or like the further south located fruit company would say, there is an app for it 😉 http://apps.splunk.com/app/489/

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...