Installation

Pre-installation Steps

This App (netflow) (https://splunkbase.splunk.com/app/489/) relies on *flow data processed by NetFlow Optimizer™ (NFO) and enables you to analyze it using Splunk® Enterprise or Splunk® Cloud. To download a free trial of NetFlow Optimizer, please visit https://www.netflowlogic.com/download/ and register to receive the FREE trial key. Please see NetFlow Optimizer Installation and NetFlow Optimizer Administration Guide and follow instructions for your platform.

Install the App on your Splunk Search Heads.

This App requires the Technology Add-On for NetFlow (TA-netflow) (https://splunkbase.splunk.com/app/1838/). This Add-on collects *flow data processed by NetFlow Optimizer™ (NFO) software by NetFlow Logic, providing Splunk CIM compliant field names, eventtypes and tags for *flow data. The Add-on can be used with the App or with Splunk Enterprise Security.

Install this Add-on on your Splunk Search Heads, Indexers, and Heavy Forwarders.

  1. Download Technology Add-on for NetFlow from Splunkbase https://splunkbase.splunk.com/app/1838/

  2. Download NetFlow Analytics for Splunk from Splunkbase https://apps.splunk.com/app/489/

  3. Download Force Directed App for Splunk to use Topology View https://splunkbase.splunk.com/app/3767/

Installing into a Single Splunk Server Deployment

Technology Add-on for NetFlow Installation

  1. Install Technology Add-on for NetFlow (TA-netflow).

  2. Create the $SPLUNK_ROOT/etc/apps/TA-netflow/local/inputs.conf file, and add the following lines to it:

    [udp://10514]
    sourcetype = flowintegrator
  3. By default NetFlow Optimizer events will be stored in main index. In case you want to use another index, for example flowintegrator, please create the $SPLUNK_ROOT/etc/apps/TA-netflow/local/indexes.conf file, and add the following lines to it:

    [flowintegrator]
    homePath = $SPLUNK_DB/flowintegrator/nfi_traffic/db
    coldPath = $SPLUNK_DB/flowintegrator/nfi_traffic/colddb
    thawedPath = $SPLUNK_DB/flowintegrator/thaweddb

    In that case make sure your $SPLUNK_ROOT/etc/apps/TA-netflow/local/inputs.conf file contains the following:

    [udp://10514]
    sourcetype = flowintegrator
    index = flowintegrator
  4. Restart Splunk

NetFlow Analytics for Splunk App Installation

  1. Install NetFlow Analytics for Splunk App (netflow).

  2. Create the file if it does not already exist: $SPLUNK_ROOT/etc/apps/netflow/local/macros.conf

  3. and add the following lines to it:

    [netflow_index]
    definition = index=flowintegrator sourcetype=flowintegrator
  4. Restart Splunk for the changes to take effect.

If you are installing the App in Splunk Cloud or use Splunk GUI, and would like to use a different index from the default main or continue using a custom index for your NetFlow events, please perform the following on your searchheads:

In Settings->Advanced search->Search macros find the “netflow index” macro, click on it and change the value in the Definition field from:

sourcetype=flowintegrator

to:

index=flowintegrator sourcetype=flowintegrator

Installing into a Distributed Splunk Deployment

If you have Splunk distributed environment (separate search heads / indexers / forwarders), install Tecnology Add-on for NetFlow (TA-netflow) on search heads, indexers, and heavy forwarders. Install NetFlow Analytics for Splunk App (netflow) on search heads.

There are three ways to ingest NetFlow Optimizer events into Splunk:

  1. NFO sends events directly to Splunk indexer

  2. NFO sends events directly to Splunk Universal Forwarder (they could be installed together or on separate machines)

  3. NFO sends events to syslog-ng or rsyslog, and Splunk Universal Forwarder sends them to Splunk indexers

Configure Universal Forwarder Input

Create or modify %SPLUNK_HOME%/etc/system/local/inputs.conf file as follows. In general there are two options, either to listen directly for netflow events on a specific port or optionally to monitor files created by syslog-ng or rsyslog.

Receiving Syslogs Directly from NFO (UDP port 10514)

Add the following lines to inputs.conf file and modify it for your netflow index, if necessary:

[udp://10514]
sourcetype = flowintegrator
index = flowintegrator

Configuring Universal Forwarder with syslog-ng or rsyslog

In this scenario syslog-ng or rsyslog are configured to listen to syslogs sent by NFO on a UDP port 10514. Syslog-ng or rsyslog are usually writing the logs into configurable directories. In this example we assume that those are written to /var/log/netflow.

Add the following lines to inputs.conf file and modify it for your netflow index, if necessary:

[monitor:///var/log/netflow]
sourcetype = flowintegrator
index = flowintegrator

It is very important to set sourcetype=flowintegrator and to point it to the index where Netflow Analytics for Splunk App and Add-on are expecting it.

Configure Universal Forwarder Output (Target Indexers)

During the installation of the Universal Forwarders a Receiving Indexer can be configured, as it can be seen here:

It is an optional step during the installation. If it was not configured or if load balancing is required, additional Receiving Indexers can be added later by adding to the %SPLUNK_HOME%/etc/system/local/outputs.conf file:

[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = 10.1.0.100:9997,10.1.0.101:9997

More info about load balancing: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setuploadbalancingd#How_load_balancing_works

Installing into a Splunk Cloud Deployment

You must be a Splunk Cloud administrator to install and manage apps in your Splunk Cloud deployment. The procedure for installing apps and add-ons for use with your Splunk Cloud instance depends on the type of your Splunk Cloud deployment and the version of Splunk Cloud that you are running. Please visit Splunk Cloud User Manual for details: https://docs.splunk.com/Documentation/SplunkCloud/8.0.2007/User/SelfServiceAppInstall.

As NetFlow Optimizer sends data out over UDP, use a Universal Forwarder or a Heavy Forwarder to listen to the NFO source and forward the data to your Splunk Cloud deployment. Please visit Splunk Cloud Admin Manual for details: https://docs.splunk.com/Documentation/SplunkCloud/8.0.2007/Admin/IntroGDI.