Getting Data In

Splunk Stream Listen Localhost and Local Interface

batabay
Path Finder

Hi, I try to listen local network adapter and localhost traffic. For that I am using splunk stream on windows 10 machine. But I noticed splunk stream doesn’t capture traffic localhost and network adapters same time. Is there a any bug ? Or that’s normal ?
My main purpose is listen TDS traffics. If I write adapters names one by one is that works.
For example in streamfwd.conf

 

 

 

[streamfwd]
port = 8889
ipAddr = 127.0.0.1
streamfwdcapture.0.interface = \Device\NPF_{D4BEDB74-F8CD-4A72-8615-ABF1E3E8823B}

 

 

 


Thats work. Also that’s work.

 

 

 

[streamfwd]
port = 8889
ipAddr = 127.0.0.1
streamfwdcapture.0.interface = \Device\NPF_Loopback

 

 

 


But that doesn’t work.

 

 

 

[streamfwd]
port = 8889
ipAddr = 127.0.0.1
streamfwdcapture.0.interface = \Device\NPF_{D4BEDB74-F8CD-4A72-8615-ABF1E3E8823B}
streamfwdcapture.1.interface = \Device\NPF_Loopback

 

 

 


How can I fix this. I have to listen all interfaces.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...