Digital Resilience Pays Off
Download this e-book to learn about the role of Digital Resilience across enterprises.
It’s easy to eat network data using Splunk. In a recent seminar I demonstrated how quickly a network administrator could dig through NetFlow data to diagnose network problems using Splunk. Here I’ll show you some steps for getting NetFlow (cflow, jflow, netstream, IPFIX, sflow) data into Splunk.
For this setup we’ll need the following:
Here are the detailed steps for setting up Splunk + NetFlow:
Please note:
1. Download & Install Splunk, flow-tools & daemontools:
# pkg_add "http://tinyurl.com/splunk3-4-fbsd63-amd64" # portinstall flow-tools # portinstall daemontools
2. Configure flow-tools & daemontools:
# mkdir -p /var/service/flow-receive # cat >/var/service/flow-receive/run<<EOF #!/bin/sh export FLOW_PIPE="/var/run/flow.pipe" if [ ! -p "\$FLOW_PIPE" ]; then mkfifo "\$FLOW_PIPE" fi /usr/local/bin/flow-receive 0/0/9800 | /usr/local/bin/flow-print -f 5 > \$FLOW_PIPE EOF # chmod +x /var/service/flow-receive/run # echo "svcscan_enable=YES">>/etc/rc.conf # /usr/local/src/rc.d/svscan.sh start # ln -s /var/service/flow-receive /service
3. Configure Splunk:
# echo >>/opt/splunk/etc/system/local/inputs.conf<<EOF [fifo:///var/run/flow.pipe] disabled = false sourcetype = netflow EOF # echo >>/opt/splunk/etc/system/local/props.conf<<EOF [netflow] AUTO_LINEMERGE = false SHOULD_LINEMERGE = false EOF # /opt/splunk/bin/splunk restart
Now we’re ready to start eating NetFlow data. In Part 2 I’ll show you how to configure your network equipment to send this data, and some ways you can use this data within Splunk.
----------------------------------------------------
Thanks!
Greg Albrecht
The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure, resilient and innovative.
Founded in 2003, Splunk is a global company — with over 7,500 employees, Splunkers have received over 1,020 patents to date and availability in 21 regions around the world — and offers an open, extensible data platform that supports shared data across any environment so that all teams in an organization can get end-to-end visibility, with context, for every interaction and business process. Build a strong data foundation with Splunk.