Running Stream against old PCAPS

[w0lverineNOP]

I am trying to run Stream against a few old pcaps. My set up includes the following:
Created a index that is pointing to an uploaded file of old pcaps had the Stream Forwarder pointed to the index
I have my host ip address added to the whitelist and is still being caught and indexed.

Any suggestions?

[rphillips_splk · Accepted solution]

Per the doc, you can edit the streamfwd.xml file:

Example 4: Use pcap file instead of network interface
You can also use a previously generated pcap file instead of an actual network interface, using this variation of the element.

<Interface>/tmp/data.cap</Interface>
<Offline>true</Offline>
<Filter>tcp port 80</Filter>
<Repeat>true</Repeat>
<SysTime>true</SysTime>
<BitsPerSecond>10000000</BitsPerSecond>

Should be set to the path of your pcap file
True means use pcap, false means is a network device name
True means to play back the pcap file repeatedly for continuous load
True means to use the system time for packet timestamps
Rate limiter, defaults to 10 Mbps if undefined and is true

http://docs.splunk.com/Documentation/StreamApp/6.1.1/DeployStreamApp/ConfigureStreamForwarder

[w0lverineNOP]

Thank you!!