App for Stream - pcap replay

[sswansonchtr]

I have a pcap with DNS traffic that I want to analyze. I downloaded the 'Stream Examples' app and the main Splunk App for Stream. There is a Stream Replay input option which I pointed at my .pcap but I don't see any data. I have the 'streamfwd' enabled and I don't see any data related to that either. I followed the Install guide for all this so I am not sure what else to do here.

Any help or troubleshooting options would be helpful.

[amiracle]

Were you able to edit the streamfwd.xml config file in the local directory for your Splunk Stream instance? Check out this link, it goes over setting up Splunk Stream to look at a specific PCAP file : https://answers.splunk.com/answers/220040/running-stream-against-old-pcaps.html

I hope that helps!

[csharp_splunk]

What operating system are you running?

[sswansonchtr]

Red Hat Enterprise Linux Server release 5.7 (Tikanga)

[csharp_splunk]

Should work. There's a long list of questions about your environment we need to ask to help troubleshoot. Given the amount of detailed work that needs to happen, support is probably a better option than Answers.

[sswansonchtr]

I will contact support. The environment is straightforward VM install with a base splunk install I use for importing logs to troubleshoot.

[vshcherbakov_sp]

What link layer your pcap file has? App for Stream only support ethernet, linux cooked sockets and DLT_NULL link types. Wireshark should be able to tell you the link type; you may also want to look for "SnifferReactor unrecognized link layer for device " error messages in the streamfwd.log file