Hello I have Splunk Streams installed on a Centos 6 Server which is also acting as a NFS Server. This is capturing packets and writing pcaps to the correct directory.
I have a Windows Search head where I have installed the Splunk Streams App. I am trying to download pcaps from the Search Head but hitting a problem.
Under windows I have the NFS Share which stores the Pcaps mounted as my S:\ drive.
When I look under the S:\ drive I can see folders arranged by date order with subfolders which contain the pcaps.
Under App:Splunk Stream ->Confgiuration I have:
Mount Point: S:\
However when I try and download a PCAP from the search head I get the error:
Unable to download PCAP file
The configured mount point (S:) for file serverX.X.X.X:/SplunkStream does not exist.
You can edit the configured value if it is incorrect.
Read more about Targeted Packet Capture