If the device can output standard v5 and v9, then it can be processed by the free application. If it is another format, such as IPFIX, then it would need to be processed by our NetFlow Integrator Standard software. Please send the logs when you are able so we can take a look. ... View more

Hello Cyphertek, Thank you for your question, allow me to assist you. What is the device you are trying to collect with the free Splunk App? If it is standard v5, v9 then it should work just fine. However, if you are your trying to collect from something else , you may need to use our Standard Edition software. Can you do the following; Stop the NetFlow Integrator server from the Application configuration screen Go to Splunk/etc/apps/netflow/bin/ /etc Modify the first line of the server.cfg file as follows From: TRACE_ERR To: TRACE_FLOOD Start the NetFlow Integrator server Let it run for a few minutes and zip up the log files located in: spunk/etc/app/netflow/logs and please open a support case at: https://netflowlogic.zendesk.com/home We can take a look and see what is taking place. Thanks! Damian ... View more

Thanks for contacting us, Essential is end of life and no longer available. If you would like to process NetFlow and take advantage of data consolidation or utilize our cyber security solutions; please visit our website for a free trial: www.netflowlogic.com. ... View more

Thanks for the feedback! Are you running our latest version of the app? I have not heard of this behavior before, would you be able to do a secure remote session so I can take a look at this on your setup? Just send me an email to support@netflowlogic.com - thanks! ... View more

The NetFlow for Splunk app does not support Cisco ASA NSEL, however, you can use our Standard Edition software available on our web site as a 30-Day free trial at: www.netflowlogic.com along with our most recent Splunk App - Cisco ASA Monitor available on Splunkbase at: http://splunk-base.splunk.com/apps/72686/cisco-asa-monitor-for-netflow-standard You can install our software in minutes, begin converting NSEL into Syslog, and utilize the Cisco ASA Monitor App to gain immediate insights such as; Top Bandwidth Consumers Top Destinations Top Violators Top Connectors Let us know if you have any questions, or require any assistance with configuration by contacting support at: https://netflowlogic.zendesk.com/home ... View more

Our NetFlow for Splunk app is bundled with our free edition and does not require a license. The Key Features are below: NetFlow to Syslog (CIM) NetFlow v5, v9 Real Time w/ One to One Conversion If you are interested in additional NetFlow and Data Consolidation, please register on our web site for a 30-day free trial of our Standard Edition. ... View more

Hi Fedsan, NetFlow Integrator™ is a software-only, rule-based streaming system. It receives NetFlow records from network devices and intelligently converts this information in real time into syslog messages, and sends them to traditional SIEM systems, like Splunk. The rules are plug-ins that provide a variety of network visibility and security services. By consolidating NetFlow records, the product reduces the amount of data forwarded to SIEM systems without losing information veracity. Our FREE Limited Edition of NetFlow Integrator has only one conversion rule that translates v5, v9 NetFlow to syslog one-to-one without any pre-processing or consolidation. It is bundled with NetFlow for Splunk application, but could be installed on a separate server, with Splunk Forwarder, or in virtual environment. If you are interested in consolidation and processing of other NetFlow such as; Palo Alto Networks, Cisco NSEL, then you will want to try either our NetFlow Essential or our Standard Edition. ... View more

The field for destination_addr is supported in another rule available in the latest beta for 2.0. You will need to register for it on our website: http://www.netflowlogic.com. If you have any additional questions or support requests, please see our support site at: https://netflowlogic.zendesk.com/home ... View more

Hi Jeff, We will be supporting Palo Alto Networks flow in our Standard Edition, not on our free edition, which is what you are using. (We expect to release it in February) If you would like to provide some input on the possible output screens for Splunk, please submit a Feature Request at: https://netflowlogic.zendesk.com/home it would be great to get your insights! ... View more

I have not seen this particular issue before; can you send me an ls -a output to support@netflowlogic.com for the following: /splunk/etc/apps/netflow and /splunk/etc/apps/netflow/flowintegrator_linux32 ... View more

Hi jtc242, We are currently working on support for Palo Alto Networks - if you can send us an email to support@netflowlogic.com I can log a feature enhancement on your behalf. It would also be great to capture any specific use cases for how you want to visualize the data. Thanks! ... View more

Our app listens for incoming NetFlow on the default port of 9995. Once received, we convert the binary NetFlow data into syslog format and send it to the local Splunk UDP data input on port 11514. Double check the settings in the app under Splunk > NetFlow for Splunk > NetFlow Integrator Server Configuration to ensure the port is set to 9995. Also verify that your device (NetFlow Exporter) is also sending to 9995. ... View more