Splunk Enterprise Security

Splunk Stream App - Ingest Pcap issue

psychogyiokosta
New Member

I installed Splunk Stream App and i try to ingest a pcap file into Splunk.

Specifically i select: Settings > Data Inputs > Pcap Files: Add New

Then i fill-in the required information as prompted by Splunk guide here: https://docs.splunk.com/Documentation/StreamApp/7.2.0/DeployStreamApp/UseStreamtoparsePCAPfiles

and click Next. I can see the file being loaded for a few seconds, but then nothing happens. I can;'t continue to the 2nd and last step of the uploading process "Done".

streamfwd.conf:

[streamfwd]
streamfwdcapture.0.offline = true
streamfwdcapture.0.interface = /path/to/pcap/testbed-13jun.pcap
streamfwdcapture.0.repeat = true

What am i doing wrong? Thank you.

0 Karma

uagrawal_splunk
Splunk Employee
Splunk Employee

You are trying to upload the .pcap file or .cap file? In which Splunk version and Stream version you are facing an issue ?

0 Karma

psychogyiokosta
New Member

hello, i am using Splunk Enterprise 8.0.0 & Splunk Stream 7.2.0 and i am trying to upload/index a .pcap file yes.

0 Karma

uagrawal_splunk
Splunk Employee
Splunk Employee

I came across one known issue of uploading the pcap files from UI: https://docs.splunk.com/Documentation/StreamApp/7.2.0/ReleaseNotes/Knownissues

You can try the following command:

./streamfwd -r pcap_file_path

0 Karma

psychogyiokosta
New Member

I believe this issue is related to mine:

https://answers.splunk.com/answers/665596/splunk-stream-app-uploading-a-large-pcap-file-fail.html

Looks like when uploading a large pcap with the UI option, it fails. I need to try with CLI commands as you suggest. I will update as soon as i can. Thanks

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...