This TA enables direct network input on Windows using tshark (part of Wireshark package), parsing (currently DNS traffic) and search time CIM mapping.. Possible use cases ------------------ - DNS Insight https://splunkbase.splunk.com/app/1827/ - DHCP Insight https://splunkbase.splunk.com/app/1837/ Installation ------------ - install Wireshark (you can deselect all components except tshark) - install TA-tshark on UF and configure forwarding - modifiy inputs.conf and bin/tcpdump.path if needed. The provided file is configured for Windows to capture port 53 (DNS) on first interface and defines the input as 'tshark:port53' sourcetype. - enable capture in inputs.conf (set disabled = 0) - restart UF Discuss the TA_tshark on Splunk Answers: http://answers.splunk.com/answers/app/4921 Contact ------- splunk@compek.net