Hello Everyone I have a problem with receiving IPFIX flow From NSX-T 3.1. this is a summary of what I do: I checked Firewall things and it doesn't have any problem because I can see IPFIX flow with Wireshark on the Splunk server. I use Splunk_TA_stream and splunk_app_stream 8.0.1 and I can Get IPFix flow with IPFIX Generator( flowalyzer). I change the Splunk Stream configuration for those IPFIX fields that NSX-T sends. because some of IPFIX is not Standard.   I changed the Splunk Stream configuration based on these Link according to this Link: https://emc.extremenetworks.com/content/oneview/docs/analytics/docs/pur_splunk.htm?Highlight=Splunk https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.0/nsxt_30_admin.pdf Does anybody have experience in Receiving IPFIX flow from NSX-T? ... View more

Hello Everyone I have a problem with receiving IPFIX flow From NSX-T 3.1. this is a summary of what I do: I checked Firewall things and it doesn't have any problem because I can see IPFIX flow with Wireshark on the Splunk server. I use Splunk_TA_stream and splunk_app_stream 8.0.1 and I can Get IPFix flow with IPFIX Generator( flowalyzer). I change the Splunk Stream configuration for those IPFIX fields that NSX-T sends. because some of IPFIX is not Standard.   I changed the Splunk Stream configuration based on these Link according to this Link: https://emc.extremenetworks.com/content/oneview/docs/analytics/docs/pur_splunk.htm?Highlight=Splunk https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.0/nsxt_30_admin.pdf Does anybody have experience in Receiving IPFIX flow from NSX-T? ... View more

Hi i installed Splunk Stream to receive IPFIX, when I generate the IPFIX log by the third-party app I can see IPFIX in Splunk, but I can't see any IPFIX Traffic Generated from NSX-T, also I can see IPFIX traffic in the Splunk's machine with Wireshark. but it doesn't show in Splunk. Has anybody faced this problem? ... View more

Hi everyone I installed Splunk 8.2.2.1 and then install Splunk Stream 801 add-on but I can't find streamfwd.conf file in Directory or find Splunk_TA_stream directory. Does anybody face this problem? did I do anything else to receive NetFlow? ... View more

We are using Splunk 7.2.6  as our Syslog server in our network environment. On the Splunk server, I added the IPFIX add-on, and on the NSX-T point the IPFIX target to the SplunkSrv:4739. We use the exact same configuration on our previous NSX-V and we were able to receive all the related packets on Splunk, but in NSX-T we are unable to do so. We check everything, local firewall rules on Splunk included, but still no chance. also, I check the Splunk server with Wireshark and I got IPFIX traffic but it doesn't show in Splunk Any thoughts? ... View more

I use API to create search https://[IPaddress]:8089/services/search/jobs Body: search sourcetype = ipfix | regex destinationIPv4Address = "^(12\.10\.2\.(?:[0-9]|[1-9][0-9]|1(?:[0-9][0-9])|2(?:[0-4][0-9]|5[0-5])))$" | stats sum(eval(octetDeltaCount/4)) as Traffic count(Sequence) as Hint values(protocol) by sourceIPv4Address destinationIPv4Address protocolIdentifier destinationTransportPort sourceTransportPort | eval protocol=case(protocolIdentifier ==1 ,"ICfMP", protocolIdentifier ==4 ,"IP", protocolIdentifier ==6 ,"ICfMP", protocolIdentifier ==17 ,"UDP",protocolIdentifier ==88 ,"EIGRP",protocolIdentifier ==89 ,"OSPF",protocolIdentifier ==103 ,"PIM",protocolIdentifier ==143 ,"EThernet") | stats sum(eval(abs(Hint/4))) as TotalHint values(sourceIPv4Address) values(sourceTransportPort) values(destinationIPv4Address) values(destinationTransportPort) values(description) values(protocol) values(protocolIdentifier) values(Traffic) by sourceIPv4Address destinationIPv4Address protocolIdentifier | append [search sourcetype %3d ipfix | regex sourceIPv4Address = "^(12\.10\.2\.(?:[0-9]|[1-9][0-9]|1(?:[0-9][0-9])|2(?:[0-4][0-9]|5[0-5])))$" | stats sum(eval(octetDeltaCount/4)) as Traffic count(Sequence) as Hint values(protocol) by sourceIPv4Address destinationIPv4Address protocolIdentifier destinationTransportPort sourceTransportPort | eval (protocol=case(protocolIdentifier ==1 ,"ICfMP", protocolIdentifier ==4 ,"IP", protocolIdentifier ==6 ,"ICfMP", protocolIdentifier ==17 ,"UDP",protocolIdentifier ==88 ,"EIGRP",protocolIdentifier ==89 ,"OSPF",protocolIdentifier ==103 ,"PIM",protocolIdentifier ==143 ,"EThernet") | stats sum(eval(abs(Hint/4))) as TotalHint values(sourceIPv4Address) values(sourceTransportPort) values(destinationIPv4Address) values(destinationTransportPort) values(description) values(protocol) values(protocolIdentifier) values(Traffic) by sourceIPv4Address destinationIPv4Address protocolIdentifier] but when I use GET to receive result I receive 204 no content message HTTPS://[Ip address]:8089/services/search/jobs/1619301754.208/results I used  %3d  instead of = in the sourcetype but it does not work anybody faced this issue? ... View more