Installation

Pre-installation Steps

This App relies on NetFlow Optimizer software. To download a free trial of NetFlow Optimizer, please visit https://www.netflowlogic.com/download/ and register to receive the FREE trial key. Please see NetFlow Optimizer Installation and NetFlow Optimizer Administration Guide and follow instructions for your platform.

NetFlow Analytics for Splunk and Add-on are designed to work together. The Add-on can be used with the App or with Splunk Enterprise Security.

  1. Download Technology Add-on for NetFlow from Splunkbase https://splunkbase.splunk.com/app/1838/

  2. Download NetFlow Analytics for Splunk from Splunkbase https://apps.splunk.com/app/489/

  3. Download Force Directed App for Splunk to use Topology View https://splunkbase.splunk.com/app/3767/

Installing into a Single Splunk Server

Technology Add-on for NetFlow Installation

  1. Install Technology Add-on for NetFlow (TA-netflow).

  2. Create the $SPLUNK_ROOT/etc/apps/TA-netflow/local/inputs.conf file, and add the following lines to it:

    [udp://10514]
    sourcetype = flowintegrator
  3. By default NetFlow Optimizer events will be stored in main index. In case you want to use another index, for example flowintegrator, please create the $SPLUNK_ROOT/etc/apps/TA-netflow/local/indexes.conf file, and add the following lines to it:

    [flowintegrator]
    homePath = $SPLUNK_DB/flowintegrator/nfi_traffic/db
    coldPath = $SPLUNK_DB/flowintegrator/nfi_traffic/colddb
    thawedPath = $SPLUNK_DB/flowintegrator/thaweddb

    In that case make sure your $SPLUNK_ROOT/etc/apps/TA-netflow/local/inputs.conf file contains the following:

    [udp://10514]
    sourcetype = flowintegrator
    index = flowintegrator
  4. Restart Splunk

NetFlow Analytics for Splunk App Installation

  1. Install NetFlow Analytics for Splunk App (netflow).

  2. Create the file if it does not already exist: $SPLUNK_ROOT/etc/apps/netflow/local/macros.conf

  3. and add the following lines to it:

    [netflow_index]
    definition = index=flowintegrator sourcetype=flowintegrator
  4. Restart Splunk for the changes to take effect.

Installing into a Distributed Splunk Environment

If you have Splunk distributed environment (separate search heads / indexers / forwarders), install Tecnology Add-on for NetFlow (TA-netflow) on search heads, indexers, and heavy forwarders. Install NetFlow Analytics for Splunk App (netflow) on search heads.

There are three ways to ingest NetFlow Optimizer events into Splunk:

  1. NFO sends events directly to Splunk indexer

  2. NFO sends events directly to Splunk Universal Forwarder (they could be installed together or on separate machines)

  3. NFO sends events to syslog-ng or rsyslog, and Splunk Universal Forwarder sends them to Splunk indexers

Configure Universal Forwarder Input

Create or modify %SPLUNK_HOME%/etc/system/local/inputs.conf file as follows. In general there are two options, either to listen directly for netflow events on a specific port or optionally to monitor files created by syslog-ng or rsyslog.

Receiving Syslogs Directly from NFO (UDP port 10514)

Add the following lines to inputs.conf file and modify it for your netflow index, if necessary:

[udp://10514]
sourcetype = flowintegrator
index = flowintegrator

Configuring Universal Forwarder with syslog-ng or rsyslog

In this scenario syslog-ng or rsyslog are configured to listen to syslogs sent by NFO on a UDP port 10514. Syslog-ng or rsyslog are usually writing the logs into configurable directories. In this example we assume that those are written to /var/log/netflow.

Add the following lines to inputs.conf file and modify it for your netflow index, if necessary:

[monitor:///var/log/netflow]
sourcetype = flowintegrator
index = flowintegrator

It is very important to set sourcetype=flowintegrator and to point it to the index where Netflow Analytics for Splunk App and Add-on are expecting it.

Configure Universal Forwarder Output (Target Indexers)

During the installation of the Universal Forwarders a Receiving Indexer can be configured, as it can be seen here:

Screen Shot 2015-07-27 at 11.28.03.png

It is an optional step during the installation. If it was not configured or if load balancing is required, additional Receiving Indexers can be added later by adding to the %SPLUNK_HOME%/etc/system/local/outputs.conf file:

[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = 10.1.0.100:9997,10.1.0.101:9997

More info about load balancing: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setuploadbalancingd#How_load_balancing_works