I am struggled in importing the pcap file for indexing.
Here is my setup:
- Win 10 Splunk
- PCAP Analyzer for Splunk Version 4.1.10
Environment Variable:
Got confused whether to set Variable as:
$SPLUNK_HOME / SPLUNK_HOME
I am current setting both to point to default installation location C:/Program Files/Splunk
File Location path:
Here should I type in a full path of the folder that contains my pcap?
Example:
If my pcap store in this directory : C:\pcap\networktraffic.pcap
Then I should type in C:\pcap\ ?
^That's my current setup
Or the Application run on its own directory which means I have to put my pcap in
C:\Program Files\Splunk\etc\apps\SplunkForPCAP\pcap\
Something like this?
Please help,I am struggled in importing the pcap file for indexing.
Here is my setup:
- Win 10 Splunk
- PCAP Analyzer for Splunk Version 4.1.10
Environment Variable:
Got confused whether to set Variable as:
$SPLUNK_HOME / SPLUNK_HOME
I am current setting both to point to default installation location C:/Program Files/Splunk
File Location path:
Here should I type in a full path of the folder that contains my pcap?
Example:
If my pcap store in this directory : C:\pcap\networktraffic.pcap
Then I should type in C:\pcap\networktraffic.pcap?
Or the Application run on its own directory which mean I have to put my pcap in
C:\Program Files\Splunk\etc\apps\SplunkForPCAP\pcap\
Something like this?
Please help
Hi, have you already checked out the following page?:
https://schwartzdaniel.com/pcap-analyzer-for-splunk-getting-started/
Let me know if it helps.