Getting Data In

Splunk on WINDOWS - Getting NetFlow into Splunk

staces65
Engager

Hi I'm new to Splunk and the tools looks very interesting - Currently Evaluating to replace ORiON SolarWinds APM.

However I'm a bit stuck.

I'n running Splunk on Windows 2008-R2 x64 and have created a TCP data Input Port 9996 for NetFlow.

I've added the following commands to my router: logging 10.32.110.110 ip flow-export destination 10.32.110.110 9996

But don't seem to be getting anything in Splunk for this hardware. can someone help. I've tried searching the documentation but feel that what woudl be really handy is if someone had a Step By Step Quide for commond configs, such as netFlow, Syslog and Windows Events...

HELP.... 🙂

Thanks In Advance

Tags (3)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

I think this has been covered several times in other answers posts. Netflow over-the-wire is not a textual format. It is a very dense binary format, and needs the assistance of some tools to format the netflow binary data into something textual (and therefore consumable by Splunk).

There is an existing app in SplunkBase, http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+for+NetFlow that has some of the necessary plumbing in place. It depends on the nfdump tool from http://nfdump.sourceforge.net/ . Whether or not nfdump works on windows is probably going to be your biggest hurdle to manage.

Some other related answers:

http://answers.splunk.com/questions/10242/how-to-configure-nfdump-to-convert-netflow-data-from-binar...

http://answers.splunk.com/questions/8162/how-can-i-use-netflow-in-splunk-when-its-on-a-windows-box-w...

http://answers.splunk.com/questions/4186/how-can-i-index-netflow

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

I think this has been covered several times in other answers posts. Netflow over-the-wire is not a textual format. It is a very dense binary format, and needs the assistance of some tools to format the netflow binary data into something textual (and therefore consumable by Splunk).

There is an existing app in SplunkBase, http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+for+NetFlow that has some of the necessary plumbing in place. It depends on the nfdump tool from http://nfdump.sourceforge.net/ . Whether or not nfdump works on windows is probably going to be your biggest hurdle to manage.

Some other related answers:

http://answers.splunk.com/questions/10242/how-to-configure-nfdump-to-convert-netflow-data-from-binar...

http://answers.splunk.com/questions/8162/how-can-i-use-netflow-in-splunk-when-its-on-a-windows-box-w...

http://answers.splunk.com/questions/4186/how-can-i-index-netflow

treinke
Builder

I would install wireshark on the Windows 2008 server and check to make sure it is receiving the traffic on 9996.

There are no answer without questions
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...