Getting Data In

How can I use Netflow in Splunk when it's on a Windows Box without buying more software?

Shane
Explorer

I'm in the middle of a POC of Splunk and would like to start putting my netflow data into it and be able to graphically represent netflow and even possibly do drill downs like so many programs do. Is this possible and if so how? I saw some stuff that said that I had to install a netflow software but they were all Unix software and I have Splunk on a Windows08/64 server.

Tags (1)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

I don't know about the "buying" part, but Splunk cannot directly digest Netflow data without some additional help. Netflow, in its native form, is a binary format that has to be extracted to plain text by something before Splunk can digest it.

A quick search for "netflow windows" turned up several options for processing Netflow data on a Windows host. Serverfault has this useful answer:

http://serverfault.com/questions/9256/netflow-collector-for-windows-free

View solution in original post

NetFlow_Logic
Contributor

NetFlow for Splunk powered by NetFlow Integrator is running on Linux and Windows (as of v3):

http://splunk-base.splunk.com/apps/22328/netflow-for-splunk-powered-by-netflow-integrator

To learn more about NetFlow Integrator please visit https://www.netflowlogic.com/

0 Karma

dwaddle
SplunkTrust
SplunkTrust

I don't know about the "buying" part, but Splunk cannot directly digest Netflow data without some additional help. Netflow, in its native form, is a binary format that has to be extracted to plain text by something before Splunk can digest it.

A quick search for "netflow windows" turned up several options for processing Netflow data on a Windows host. Serverfault has this useful answer:

http://serverfault.com/questions/9256/netflow-collector-for-windows-free

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...