No Syslog or Netflow data | Aucune donnée Syslog ou Netflow

[Amory]

Hello,
I have installed Splunk enterprise on windows server in order to retrieve Netflow (Port 2055) and Syslog (Port 514) information.
I added in “Data Inputs” the UDP 2055 sourcetype=“Netflow” and 514 sourcetype=“Syslog”.
In “Forwarding and receiving” and then “Forwarding defaults” I checked yes.
But I can't see anything in Splunk. So I installed Wireshark, which does see Syslog and Netflow data.
I checked with PowerShell that the port was open and that splunkd was listening (netstat -ano | findstr :2055) & (tasklist | findstr XXXX).

I've also installed several add-ons but with no conclusive result.

Has anyone had this problem before or have any clues as to how to solve it?

Thanks in advance

-----------------------------------------------------------

Bonjour,
J'ai installé Splunk entreprise sur windows serveur afin de récupérer les infos de type Netflow (Port 2055) et Syslog (Port 514).
J'ai ajouté dans "Data Inputs" l'UDP 2055 sourcetype="Netflow" et 514 sourcetype="Syslog".
Dans "Forwarding and receiving" et puis "Forwarding defaults" j'ai coché oui.
Mais je ne vois absolument rien dans Splunk. J'ai donc installé Wireshark qui lui voit bien les données Syslog et Netflow.
J'ai regardé avec PowerShell si le port est bien ouvert et que c'est bien splunkd qui écoute (netstat -ano | findstr :2055) & (tasklist | findstr XXXX).

J'ai également installé plusieurs add-on mais sans résultat concluant.

Quelqu'un a déjà eu le problème ou aurait une piste de solution ?

Merci d'avance

[svelednitsky]

Bonjour Amory,

NetFlow Analytics for Splunk App and TA-netflow are designed to work with NetFlow Optimizer. For details, please visit: https://docs.netflowlogic.com/integrations-and-apps/integrations-with-splunk/

If you have any questions or would like to see a demo, please contact us at team_splunk@netflowlogic.com