Getting Data In

Indexing a NetFlow logic - log file.

chimbudp
Contributor

I have configured the inputs.conf to monitor the log file of NetFlow logic
Since the log file is in unreadable format , i set the props.conf to NO_BINARY_CHECK =1

After that i receive the logs in the below format . Is this the correct one ? am i missing something here ?

2014-01-29T05:56:35+00:00 10.0.255.245
\x84R\xE8\x98%\x00d\xD2I\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
\xA6\xA3\x00{\x00\x00\x96\x00\x00
: \x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00\xCC\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
"\xB3\xDE\x00\x00\x96\x00\x00
\x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00-\x00\x00\x00\x00\x00\x00\x00 \xAC
\xAC
\xB3\xDE"\x00\x00\xC6\x00\x00
\x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00\x00\xA4\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC
"\xB3\xDD\x00\x00\x96\x00\x00
\x00\x00\x00\x00\x00\x8A\x00\x8A\xBE\xEF\x00\x00\x00\x00\x00\x00\xB0\x00\x00\x00\x00\x00\x00\x00\xAC
\xAC

Ayn
Legend

Without knowing the exact format of the file - if the file is in a binary format, you shouldn't be pointing Splunk to read it directly. Splunk has no magic "decoding" of binary files, it indexes what it gets as-is. All you achieve by setting NO_BINARY_CHECK is to force Splunk to read all that non-readable data even though it doesn't make sense to do so.

What you need is something that will decode this data from the binary format to a textual representation of it, and then have Splunk read that output instead. Again, I don't know the exact format of this file that you're referring to, but some kind of flow reader would do this.

MuS
SplunkTrust
SplunkTrust

or like the further south located fruit company would say, there is an app for it 😉 http://apps.splunk.com/app/489/

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...