splunk stream

[iherb_0718]

All,

I have a few questions related to splunk stream

1) If a windows computer has splunk stream app installed and it has a UF installed, what are some differences in logging activity will I get between the two?

2) Does the splunk stream app get deployed from the deployment server just as the UF does?

3) Does splunk stream log just web traffic?

[iherb_0718]

Scelikok, assume I have all the work for splunk stream done on the splunk side.  That is I got the splunk stream app deployed to the heavy forwarder.  This would still require an app on the client side?  The client already has a UF.  It wouldn't be just tweaking the UF conf files to get stream?

[scelikok · Accepted solution]

@iherb_0718,

I assume you installed The Splunk App for Stream on Heavy Forwrder to manage Stream configuration on UFs.

You should install  "The Splunk Add-on for Stream Forwarders (Splunk_TA_stream)" on every client that you want to collect stream data.

If this reply helps you an upvote is appreciated.

[scelikok]

Hi @iherb_0718,

You can find all information regarding Stream on Splunk docs below;

https://docs.splunk.com/Documentation/StreamApp/7.3.0/DeployStreamApp/AboutSplunkStream 

Answers to your questions;

1) Splunk Stream App cannot work standalone it should deployed to UF or Splunk Instance. It adds network traffic capture or PCAP ingestion capabilities to Splunk.

2) You can deploy from deployment server.

3) Supported protocols can be found in documentation. https://docs.splunk.com/Documentation/StreamApp/7.3.0/DeployStreamApp/ProtocolDetection  

If this reply helps you an upvote is appreciated.