Getting Data In

Splunk Stream

mdespot
New Member

Dear

I am using network monitoring sensor (linux machine). I have deployed universal forwarder on this sensor. What i am looking for is to ingest IPFIX data directly from incoming interface on this sensor (eth0) or from a directory (file) and send this data to the Indexer. 

Looking to a Splink Stream documentation I cant find proper way to solve this problem.

Looking forward to reading from you soon

Labels (1)
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Have you gone through the Splunk Stream Supported protocols? https://docs.splunk.com/Documentation/StreamApp/7.2.0/DeployStreamApp/ProtocolDetection You'll notice, that IPFIX is not listed here.

Now that being said, you can use Netflow to aggregate IPFIX flows into stream. This is documented here : https://docs.splunk.com/Documentation/StreamApp/7.2.0/DeployStreamApp/UseStreamtoingestNetflowandIPF...

Another option is that you can also ingest pcap files that have IPFIX in them also : https://docs.splunk.com/Documentation/StreamApp/7.2.0/DeployStreamApp/UseStreamtoparsePCAPfiles

Most of your stream questions regarding configuration, deployment, and protocol support can be found here : https://docs.splunk.com/Documentation/StreamApp/7.2.0/DeployStreamApp/AboutSplunkAppforStream

 

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...