Deployment & Configuration: Sumo Logic

To integrate NetFlow Optimizer (NFO) with Sumo Logic, you must set up a Hosted Collector to receive data and configure NFO to deliver its enriched JSON stream via the HTTP Logs Source.

---

1. Sumo Logic Preparation

Before configuring NFO, you must create an endpoint in Sumo Logic to accept the incoming telemetry.

Create a Hosted Collector

1. Log in to your Sumo Logic account.
2. Navigate to Manage Data > Collection > Collection.
3. Click Add Collector and select Hosted Collector.
4. Enter a name (e.g., NFO_Collector) and click Save.

Add an HTTP Logs Source

1. In the new Hosted Collector, click Add Source and select HTTP Logs and Metrics.
2. Name: Enter NFO_JSON_Stream.
3. Source Category: Enter netflow/enriched (this is used to scope your searches and dashboards).
4. Click Save and copy the generated HTTP Source URL.

---

2. Configuring NFO Output

With your HTTP Source URL ready, establish the connection in the NFO web interface.

1. In the NFO GUI, navigate to Data Outputs and click the plus sign (+) to add a new destination.
2. Type: Select Sumo Logic.
3. URL: Paste the HTTP Source URL obtained from Sumo Logic.
4. Output Filter: Set to Modules output only to ensure only enriched data is sent.
5. nfc_id filter: Enter the module IDs (e.g., 20062) to specify which enriched telemetry to push.

---

3. Installation of the NetFlow App

Once data is flowing, you can install the pre-built visualizations from the Sumo Logic App Catalog.

1. In Sumo Logic, go to App Catalog.
2. Search for NetFlow Optimizer.
3. Click Add to Library.
4. In the configuration wizard, select the Source Category you defined in Step 1 (e.g., netflow/enriched).

---

4. Verification

To confirm that enriched data is arriving correctly, run a simple search in the Sumo Logic Log Search tab:

_sourceCategory=netflow/enriched
| json "src_vm_n", "dest_vm_n", "bytes"

Verify that the virtual machine names (src_vm_n) are populated, confirming that NFO's enrichment is working as expected.