Getting Data In

Splunk on WINDOWS - Getting NetFlow into Splunk

Engager

Hi I'm new to Splunk and the tools looks very interesting - Currently Evaluating to replace ORiON SolarWinds APM.

However I'm a bit stuck.

I'n running Splunk on Windows 2008-R2 x64 and have created a TCP data Input Port 9996 for NetFlow.

I've added the following commands to my router: logging 10.32.110.110 ip flow-export destination 10.32.110.110 9996

But don't seem to be getting anything in Splunk for this hardware. can someone help. I've tried searching the documentation but feel that what woudl be really handy is if someone had a Step By Step Quide for commond configs, such as netFlow, Syslog and Windows Events...

HELP.... 🙂

Thanks In Advance

Tags (3)
1 Solution

SplunkTrust
SplunkTrust

I think this has been covered several times in other answers posts. Netflow over-the-wire is not a textual format. It is a very dense binary format, and needs the assistance of some tools to format the netflow binary data into something textual (and therefore consumable by Splunk).

There is an existing app in SplunkBase, http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+for+NetFlow that has some of the necessary plumbing in place. It depends on the nfdump tool from http://nfdump.sourceforge.net/ . Whether or not nfdump works on windows is probably going to be your biggest hurdle to manage.

Some other related answers:

http://answers.splunk.com/questions/10242/how-to-configure-nfdump-to-convert-netflow-data-from-binar...

http://answers.splunk.com/questions/8162/how-can-i-use-netflow-in-splunk-when-its-on-a-windows-box-w...

http://answers.splunk.com/questions/4186/how-can-i-index-netflow

View solution in original post

SplunkTrust
SplunkTrust

I think this has been covered several times in other answers posts. Netflow over-the-wire is not a textual format. It is a very dense binary format, and needs the assistance of some tools to format the netflow binary data into something textual (and therefore consumable by Splunk).

There is an existing app in SplunkBase, http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+for+NetFlow that has some of the necessary plumbing in place. It depends on the nfdump tool from http://nfdump.sourceforge.net/ . Whether or not nfdump works on windows is probably going to be your biggest hurdle to manage.

Some other related answers:

http://answers.splunk.com/questions/10242/how-to-configure-nfdump-to-convert-netflow-data-from-binar...

http://answers.splunk.com/questions/8162/how-can-i-use-netflow-in-splunk-when-its-on-a-windows-box-w...

http://answers.splunk.com/questions/4186/how-can-i-index-netflow

View solution in original post

SplunkTrust
SplunkTrust

I would install wireshark on the Windows 2008 server and check to make sure it is receiving the traffic on 9996.

0 Karma