Getting Data In

How to configure nfdump to convert Netflow data from binary to text or csv?

tgow
Splunk Employee
Splunk Employee

I need to convert netflow data from binary to text or csv so that it can be splunked. I have downloaded nfdump and was looking for any information on how to configure it?

Also, is there a better free tool then nfdump

Thanks,

Todd

Tags (1)
2 Solutions

Starlette
Contributor

Did you get it up and let it capture flows and writing it to disk? On http://nfdump.sourceforge.net/ are the fundamentals. So after download, untar, ./configure , make , make install ( and some dependecies like gcc, flex and others its there)

to get the deamon up : nfcapd -w -D -l /flow_base_dir/router1 -p 23456

so a port per flow,,,you should then have the rolling binaries in the /flow_base_dir/router1

But then comes the part which I am doubting as well, cause with nfdump you can convert the binaries to stdout in ascii and to a file as,,,,binary

So it looks like you have to redirect nfdump "command for doing reversing dirs" >> file and splunk that but how to prevent dups here?

OR use scripted input,,,I am hoping that someone has been so far.

anyone?

Cheers

View solution in original post

araitz
Splunk Employee
Splunk Employee

Starlette
Contributor

Did you get it up and let it capture flows and writing it to disk? On http://nfdump.sourceforge.net/ are the fundamentals. So after download, untar, ./configure , make , make install ( and some dependecies like gcc, flex and others its there)

to get the deamon up : nfcapd -w -D -l /flow_base_dir/router1 -p 23456

so a port per flow,,,you should then have the rolling binaries in the /flow_base_dir/router1

But then comes the part which I am doubting as well, cause with nfdump you can convert the binaries to stdout in ascii and to a file as,,,,binary

So it looks like you have to redirect nfdump "command for doing reversing dirs" >> file and splunk that but how to prevent dups here?

OR use scripted input,,,I am hoping that someone has been so far.

anyone?

Cheers

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...