Splunk on WINDOWS - Getting NetFlow into Splunk

[staces65]

Hi I'm new to Splunk and the tools looks very interesting - Currently Evaluating to replace ORiON SolarWinds APM.

However I'm a bit stuck.

I'n running Splunk on Windows 2008-R2 x64 and have created a TCP data Input Port 9996 for NetFlow.

I've added the following commands to my router: logging 10.32.110.110 ip flow-export destination 10.32.110.110 9996

But don't seem to be getting anything in Splunk for this hardware. can someone help. I've tried searching the documentation but feel that what woudl be really handy is if someone had a Step By Step Quide for commond configs, such as netFlow, Syslog and Windows Events...

HELP.... 🙂

Thanks In Advance

[dwaddle · Accepted solution]

I think this has been covered several times in other answers posts. Netflow over-the-wire is not a textual format. It is a very dense binary format, and needs the assistance of some tools to format the netflow binary data into something textual (and therefore consumable by Splunk).

There is an existing app in SplunkBase, http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+for+NetFlow that has some of the necessary plumbing in place. It depends on the nfdump tool from http://nfdump.sourceforge.net/ . Whether or not nfdump works on windows is probably going to be your biggest hurdle to manage.

Some other related answers:

http://answers.splunk.com/questions/10242/how-to-configure-nfdump-to-convert-netflow-data-from-binar...

http://answers.splunk.com/questions/8162/how-can-i-use-netflow-in-splunk-when-its-on-a-windows-box-w...

http://answers.splunk.com/questions/4186/how-can-i-index-netflow

[treinke]

I would install wireshark on the Windows 2008 server and check to make sure it is receiving the traffic on 9996.