Getting Data In

Splunk Stream Listen Localhost and Local Interface

batabay
Path Finder

Hi, I try to listen local network adapter and localhost traffic. For that I am using splunk stream on windows 10 machine. But I noticed splunk stream doesn’t capture traffic localhost and network adapters same time. Is there a any bug ? Or that’s normal ?
My main purpose is listen TDS traffics. If I write adapters names one by one is that works.
For example in streamfwd.conf

 

 

 

[streamfwd]
port = 8889
ipAddr = 127.0.0.1
streamfwdcapture.0.interface = \Device\NPF_{D4BEDB74-F8CD-4A72-8615-ABF1E3E8823B}

 

 

 


Thats work. Also that’s work.

 

 

 

[streamfwd]
port = 8889
ipAddr = 127.0.0.1
streamfwdcapture.0.interface = \Device\NPF_Loopback

 

 

 


But that doesn’t work.

 

 

 

[streamfwd]
port = 8889
ipAddr = 127.0.0.1
streamfwdcapture.0.interface = \Device\NPF_{D4BEDB74-F8CD-4A72-8615-ABF1E3E8823B}
streamfwdcapture.1.interface = \Device\NPF_Loopback

 

 

 


How can I fix this. I have to listen all interfaces.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...