Monitoring Splunk

Monitoring network traffic on a sub-net

gtrapp
New Member

I'd like to monitor network traffic on a sub-net with ~ 10 hosts. This is a remote office with no server and I can get to the network via a frame-relay connection. I cannot modify any settings on the frame-relay router and the switch is this office is not managable. I'm trying to get splunk Ver 4.2.4 to do this but having trouble. Is there a step-by-step to setting this up?

Thanks in advance.

Tags (1)
0 Karma

gtrapp
New Member

I'm basing my question on this link: "Free Network Monitoring / www.splunk.com/Network_Monitoring / Monitor Your Network for slow or failing components. Free Download!" which Splunk is advertising on google search pages.
From the download page and some of the questions I reviewed (before installing the product) it seemed like I could capture network traffic and then easily analyze it in Splunk. I've tried capturing network traffic through a TCPIP connection but that doesn't seem to work.

0 Karma

Ayn
Legend

I haven't seen the ads so I don't know what they're claiming. You cannot use Splunk to directly capture network traffic.

0 Karma

Ayn
Legend

What exact role are you expecting Splunk to have in this? Splunk does not in itself have any network monitoring capabilities. Sure, you could build something that records network data and feeds it to Splunk in non-binary format, Splunk will happily index anything resembling text data. Your issue seems to have more with how to get the monitoring going rather than what to do with the data in Splunk once it's there, though. As such I'm fairly sure there is no step-by-step guide for you to follow, but if you elaborate a bit more on what you would like Splunk to do in your setup we can take it from there.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...