Splunk Enterprise

Empty fields within Splunk Stream NetFlow Data

pipehitter
Explorer

Hi everyone, 

we are currently in a migration project and want to process NetFlow data within Splunk. For this purpose, we are using Splunk Stream and the associated apps (Add-On for Stream Forwarders/Add-On for Stream Wire Data) and we are receiving a lot of data from the respective system. Unfortunately, many fields in this data remain empty, even though they can be read from the same system using the current NetFlow tool. We selected every possible field from the configuration within the GUI changed the NetFlow version from 5 to 9 and IPFIX without any positive outcome.

The fields which are interessting for us are the following:

interface name

app

app_desc

protocol (tcp or udp)

 

Are there any additional configuration options available or did anyone experienced this issue ?

 

Thanks in advance 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...