How to Monitor NetFlow Traffic in Splunk Cloud

[AJH2000]

Hello everyone,

I’m currently using Splunk Cloud in my organization and I’m interested in monitoring NetFlow traffic for our network infrastructure.

I’d like to know:

1. Are there real-world examples or success stories of integrating NetFlow data into Splunk Cloud?

2. What recommended approaches or best practices exist for this?

3. Is there any official guide or community-proven workflow for configuring the ingestion and visualization of NetFlow within Splunk Cloud?

Any insights, references to documentation, or lessons learned from your own deployments would be greatly appreciated.

Thank you in advance!

[PickleRick]

The architecture and installation is described here and in subsequent chapters https://docs.splunk.com/Documentation/StreamApp/8.1.5/DeployStreamApp/CloudArchitecture

Do you have any particular problem with your installation?

If you want someone to design and deploy a complete solution for you contact your local friendly Splunk Partner.

[malopez_riv · Accepted solution]

 Hi Friend, 

I recently integrated Netflow to Splunk Cloud, I'm using stream forwarder app just consider that Netflow generates a lot of events so you have to consider the amount of license to ingest the events or create or create filters to discard events or ingest the specific IPs that you need. The guide for Stream Forwarder is the following:

https://docs.splunk.com/Documentation/StreamApp/8.1.5/DeployStreamApp/AboutSplunkStream

In my case, I have some issues with the version 8.1.5 so my integration is working perfect with the 8.1.3.