there are several possibilities for it with pro/con each time
if you go the stream way, just install the stream app following the docs and configure it to collect your network data directly. (ie your network device will send them to stream)
for the collection part, it can be a UF with stream TA (probably easier to start with) or a streamfwd
if you go the TA way without stream, the splunk TA for netflow include a collector for netflow , which will make the conversion to log files before data being injected into splunk (so the future is probably to go the stream way)
or there's another third party TA including a collector on splunkbase, altough you'll probably need a specific license for it.
so look to all solutions, tests and choose the one that best fit your needs
Hope that helps.
... View more