Hi everyone,
we are currently in a migration project and want to process NetFlow data within Splunk. For this purpose, we are using Splunk Stream and the associated apps (Add-On for Stream Forwarders/Add-On for Stream Wire Data) and we are receiving a lot of data from the respective system. Unfortunately, many fields in this data remain empty, even though they can be read from the same system using the current NetFlow tool. We selected every possible field from the configuration within the GUI changed the NetFlow version from 5 to 9 and IPFIX without any positive outcome.
The fields which are interessting for us are the following:
interface name
app
app_desc
protocol (tcp or udp)
Are there any additional configuration options available or did anyone experienced this issue ?
Thanks in advance
