Have you gone through the Splunk Stream Supported protocols? https://docs.splunk.com/Documentation/StreamApp/7.2.0/DeployStreamApp/ProtocolDetection You'll notice, that IPFIX is not listed here. Now that being said, you can use Netflow to aggregate IPFIX flows into stream. This is documented here : https://docs.splunk.com/Documentation/StreamApp/7.2.0/DeployStreamApp/UseStreamtoingestNetflowandIPFIXdata.  Another option is that you can also ingest pcap files that have IPFIX in them also : https://docs.splunk.com/Documentation/StreamApp/7.2.0/DeployStreamApp/UseStreamtoparsePCAPfiles Most of your stream questions regarding configuration, deployment, and protocol support can be found here : https://docs.splunk.com/Documentation/StreamApp/7.2.0/DeployStreamApp/AboutSplunkAppforStream   ... View more