Can anyone help to clarify if it is possible to configure/enhance a level of details splunk stream provides from pcaps? I was testing upload of small pcap file with only one package (tls 1.0 handshake package) and the result was:
here is cli output when I was uploading the pcap. There is a netflow error but I do not expect any netflows there:
[root@xxxx splunk]# sudo -u splunker ./etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwd -r /tmp/2500857281303226393.pcap --index stream_pcap
06:40:56.334 INFO stream.CaptureServer - Found DataDirectory: /opt/splunk/etc/apps/Splunk_TA_stream/data
06:40:56.334 INFO stream.CaptureServer - Found UIDirectory: /opt/splunk/etc/apps/Splunk_TA_stream/ui
06:40:56.895 INFO stream.StreamSender - Successfully pinged server (config needs update): 1fbf522d-9e4d-489f-8f76-dc472e672025
06:40:56.895 INFO stream.CaptureServer - Default configuration directory: /opt/splunk/etc/apps/Splunk_TA_stream/default
06:40:56.897 INFO stream.CaptureServer - Start sending pcap data
06:40:56.898 INFO stream.StreamSender - Successfully pinged server (config needs update): 1fbf522d-9e4d-489f-8f76-dc472e672025
06:40:56.942 INFO stream.CaptureServer - Configuring offline capture with pcap file /tmp/2500857281303226393.pcap
06:40:56.943 INFO stream.CaptureServer - Starting data capture
06:40:56.944 INFO stream.SnifferReactor - Starting network capture: sniffer
06:40:56.947 ERROR stream.CaptureServer - NetFlow receiver configuration is not set in streamfwd.conf. NetFlow data will not be captured. Please update streamfwd.conf to include correct NetFlow receiver configuration.
06:40:56.947 ERROR stream.CaptureServer - File extraction is enabled in one of the streams but file mount point information is not set in streamfwd.conf. Extracted files will not get saved in file system.
06:40:56.947 INFO stream.SnifferReactor - All capture devices have finished: sniffer
06:40:56.947 INFO stream.main - streamfwd has started successfully (version 7.1.1 build 137)
06:40:57.198 INFO stream.StreamSender - (#0) Connection established to 127.0.0.1:8889
06:40:57.448 INFO stream.CaptureServer - Finished sending pcap data; shutting down
06:40:57.448 INFO stream.main - streamfwd is shutting down pid: 20041
Thank you in advance for any help.
... View more
We are running Splunk 6.5.3 and I have issue with the Splunk Web interface on Heavy Forwarder. The web interface behaves randomly. Really randomly:
- It tells me I have unsupported browser
- It lets me log in normally or it loads a page correctly
- It does not loads pages or icons
- It is not accessible at all
I am accessing it through WAN link so the connection may be slow. I tried to remove the DB connect and it did not help. It is fresh installation -- no upgrade. I need the web to configure DB connect :(.
It is close to this issue but the bug should be fixed in 6.5.3:
The only line found in logs:
06-06-2017 11:21:15.827 -0400 WARN HttpListener - Socket error from while idling: Read Timeout
Some screen shots:
... View more
does anyone know if there is any communication between License Master and Heavy Forwarder initiated by the License Master. I know that Heavy Forwarder initiate some communication with License Master to download license information. I also found that indexers are reporting every minute an amount if indexed data to License Master. However I have not found any official Splunk explanation what communications exist and how the components exactly talk together.
There is a simple reason for this question ... our firewall guys are complaining to open tcp/8089 initiated from License Master to Heavy Forwarders.
Thanks to anyone for an answer.
... View more
- Universal forwarder pointed to a temp Deployment server
- Two applications are deployed on the Universal Forwarder from the temp Deployment server
What happened with the two applications if I change Universal Forwarder deployment server configuration and point it to a new Deployment server? The new Deployment server is a fresh server with no applications defined and it is intended.
- Will the applications be deleted by Universal Forwarder?
- Will the applications remain and will be not managed?
Thank you in advance for any reply.
... View more