All Apps and Add-ons

Stream App: Where does the streamfwd do with the .cap data once it successfully executed?

w0lverineNOP
Path Finder

I have successfully ran the command ./streamfwd against a .cap file but I am not sure where the streamfwd indexed the data too.

I have not changed the default index in stream of the forwarder. So my question is where does streamfwd store the with the data once ./streamfwd runs through the .cap file?

I have looked through all the indexes and their is no data anywhere.

Tags (2)
0 Karma
1 Solution

mdickey_splunk
Splunk Employee
Splunk Employee

The streamfwd command line executable sends events from pcap files to the Wire Data modular input (provided by the Splunk_TA_stream app) via TCP port 8889. You should run this on the same machine that has the wire data input running; either your splunk server for single-server deployment, or a universal forwarder with Splunk_TA_stream enabled. You can also forward the events to a remote server or alternate port using the -s command line option (the default is localhost, port 8889).

View solution in original post

0 Karma

mdickey_splunk
Splunk Employee
Splunk Employee

The streamfwd command line executable sends events from pcap files to the Wire Data modular input (provided by the Splunk_TA_stream app) via TCP port 8889. You should run this on the same machine that has the wire data input running; either your splunk server for single-server deployment, or a universal forwarder with Splunk_TA_stream enabled. You can also forward the events to a remote server or alternate port using the -s command line option (the default is localhost, port 8889).

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...