Getting Data In

How to ingest netflow/sflow logs

hkumar26
New Member

We intend to collected netflow/sflow logs in our Splunk Enterprise solution. I read that there is an app required to collect logs. Also I came across splunk docs to configure flow collector- https://docs.splunk.com/Documentation/StreamApp/7.1.0/DeployStreamApp/ConfigureFlowcollector

This link doesn't mention about app. Do I need the app or the process mention in docs? which is recommended method?

Thanks,

0 Karma
1 Solution

maraman_splunk
Splunk Employee
Splunk Employee

there are several possibilities for it with pro/con each time
if you go the stream way, just install the stream app following the docs and configure it to collect your network data directly. (ie your network device will send them to stream)
for the collection part, it can be a UF with stream TA (probably easier to start with) or a streamfwd

if you go the TA way without stream, the splunk TA for netflow include a collector for netflow , which will make the conversion to log files before data being injected into splunk (so the future is probably to go the stream way)

or there's another third party TA including a collector on splunkbase, altough you'll probably need a specific license for it.

so look to all solutions, tests and choose the one that best fit your needs

Hope that helps.

View solution in original post

0 Karma

maraman_splunk
Splunk Employee
Splunk Employee

there are several possibilities for it with pro/con each time
if you go the stream way, just install the stream app following the docs and configure it to collect your network data directly. (ie your network device will send them to stream)
for the collection part, it can be a UF with stream TA (probably easier to start with) or a streamfwd

if you go the TA way without stream, the splunk TA for netflow include a collector for netflow , which will make the conversion to log files before data being injected into splunk (so the future is probably to go the stream way)

or there's another third party TA including a collector on splunkbase, altough you'll probably need a specific license for it.

so look to all solutions, tests and choose the one that best fit your needs

Hope that helps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...