Skip to main content
Version: 2.11.3

Installation

Pre-installation Steps​

NetFlow and SNMP Analytics for Splunk App relies on *flow data processed by NetFlow Optimizer™ (NFO) and enables you to analyze it using Splunk® Enterprise or Splunk® Cloud.

To download a free trial of NetFlow Optimizer, please visit https://www.netflowlogic.com/download/ and register to receive the FREE trial license. Please see NetFlow Optimizer Installation and NetFlow Optimizer Administration Guide and follow instructions for your platform.

NetFlow data is sent to Splunk from NFO in syslog or JSON formats.

Whether you use Splunk Enterprise or Splunk Cloud, configure your Splunk Data inputs accordingly per your accepted best practices.

You need to install both NetFlow and SNMP Analytics for Splunk App and Technology Add-On for NetFlow:

NFO can send data to Splunk using one of the following options:

  • Directly on UDP input port of Splunk Indexer (OK for POC, but not recommended in production due to potential loss of data)
  • Via Splunk HEC
  • Via Splunk Forwarder
  • Via rsyslog / syslog-ng and Splunk forwarders
  • Via Splunk Connect for Syslog

Installing into a Splunk Cloud Deployment​

You must be a Splunk Cloud administrator to install and manage apps in your Splunk Cloud deployment. The procedure for installing apps and add-ons for use with your Splunk Cloud instance depends on the type of your Splunk Cloud deployment and the version of Splunk Cloud that you are running. Please visit Splunk Cloud Platform Admin Manual for details: https://docs.splunk.com/Documentation/SplunkCloud/latest/Admin/SelfServiceAppInstall.

Installing Splunk App and TA​

Install the App on your Splunk Search Heads​

NetFlow and SNMP Analytics for Splunk App (netflow) is available here: (https://splunkbase.splunk.com/app/489/).

Several dashboards of the App rely on Force Directed App for Splunk for Topology View. Please make sure it is installed in your Splunk environment: https://splunkbase.splunk.com/app/3767/ to use Topology View.

This App requires the Technology Add-On for NetFlow (TA-netflow).

Install Add-on on your Splunk Search Heads, Indexers, and Heavy Forwarders​

Technology Add-On for NetFlow (TA-netflow) is available here: (https://splunkbase.splunk.com/app/1838/). This Add-on collects *flow data processed by NetFlow Optimizer™ (NFO) software by NetFlow Logic, providing Splunk CIM compliant field names, event types and tags for *flow data. The Add-on can be used with the App, Splunk Enterprise Security, Splunk ITSI, and Splunk IT Essentials Works App.

Installing into Splunk Enterprise​

Technology Add-on for NetFlow Installation​

This TA enables you to ingest flow data into events index or metrics index.

Choose Events index if you need access to raw events. However, this option results in slower performance.

Choose Metrics index for better performance with large volumes of flow data, but you need to use mpreview or mstats command to search and view your data.

By default NetFlow Optimizer events will be stored in main index. In case you want to use another index, for example flowintegrator, go to Settings->Indexes and if the [flowintegrator] index is not present click on the New Index button, enter flowintegrator and click Save.

Alternatively, if you have SSH access to your Splunk servers, please perform the following:

Create the $SPLUNK_ROOT/etc/apps/TA-netflow/local/indexes.conf file, and add the following lines to it:

[flowintegrator]
homePath    = $SPLUNK_DB/flowintegrator/db
coldPath    = $SPLUNK_DB/flowintegrator/colddb
thawedPath  = $SPLUNK_DB/flowintegrator/thaweddb

Set sourcetype to flowintegrator In your Data inputs

Restart Splunk

NetFlow Analytics for Splunk App Installation​

After installing NetFlow and SNMP Analytics for Splunk App, go to Settings->Advanced search->Search macros. Find [netflow_index] macro, click on it, and change the definition toindex=flowintegrator sourcetype=flowintegrator .

Alternatively, if you have SSH access to your Splunk servers, please perform the following:

Create the file if it does not already exist: $SPLUNK_ROOT/etc/apps/netflow/local/macros.conf, and add the following lines to it:

[netflow_index]
definition = index=flowintegrator sourcetype=flowintegrator

Restart Splunk for the changes to take effect.