I have multiple devices sending Netflow v5 data to Splunk Stream. And they are all being captured by one stream. Is there any way to differentiate sources of netflow data without installing separate splunk stream forwarders for each device? I tried to use exporter_ip field with no luck - it's just empty. They are all sending data to different ports on the splunk stream, but I don't see this information in splunk index. May be there is some way to configure Splunk Stream to send data to separate streams based on the port numbers that the data is being captured on?
Thanks,
Roman
... View more