Install Splunk App and Add-on

Search…
This section describes installation, configuration, and user instructions of Splunk’s solution components. They are: NetFlow Analytics for Splunk App (https://splunkbase.splunk.com/app/489/) and Technology Add-on for NetFlow (https://splunkbase.splunk.com/app/1838/). The App and Add-on are designed to work together.
The App expects data in sourcetype=flowintegrator.
Installing into a Single Splunk Server
Step 1: Install the App and Add-on 
Step 2: Create the Splunk data input
​
1.Create the $SPLUNK_ROOT/etc/apps/TA-netflow/local/inputs.conf file, and add the following lines to it:
1
[udp://10514]
2
sourcetype = flowintegrator
Copied!
2.By default, NetFlow Optimizer events will be stored in the main index. In case you want to use another index, for example flowintegrator, please create the $SPLUNK_ROOT/etc/apps/TA-netflow/local/indexes.conf file, and add the following lines to it: 
1
[flowintegrator]
2
homePath    = $SPLUNK_DB/flowintegrator/nfi_traffic/db
3
coldPath    = $SPLUNK_DB/flowintegrator/nfi_traffic/colddb
4
thawedPath  = $SPLUNK_DB/flowintegrator/thaweddb
Copied!
In that case make sure your $SPLUNK_ROOT/etc/apps/TA-netflow/local/inputs.conf file contains the following: 
1
[udp://10514]
2
sourcetype = flowintegrator
3
index = flowintegrator
Copied!
Also, in the NetFlow Analytics for Splunk App (netflow) you need to create $SPLUNK_ROOT/etc/apps/netflow/local/macros.conf file containing the following. Edit this file to match your Splunk installation. 
1
[netflow_index] 
2
definition = (index=main OR index=flowintegrator) sourcetype=flowintegrator
Copied!
3.Restart Splunk
Installing into a Distributed Splunk Environment
If you have a Splunk distributed environment (separate search heads / indexers / forwarders), install the NetFlow Analytics for Splunk App on the search heads. Install Add-on on the search heads and indexers/heavy forwarders. 
There are three ways to ingest NetFlow Optimizer events into Splunk: 
1.NFO sends events directly to the Splunk indexer
2.NFO sends events directly to the Splunk Universal Forwarder (they could be installed together or on separate machines)
3.NFO sends events to syslog-ng or rsyslog, and the Splunk Universal Forwarder sends them to Splunk indexers
Configure Universal Forwarder 
Input Create or modify the %SPLUNK_HOME%/etc/system/local/inputs.conf file as follows. In general, there are two options, either to listen directly for netflow events on a specific port or optionally to monitor files created by syslog-ng or rsyslog. 
Receiving Syslogs Directly from NFO (UDP port 10514) 
Add the following lines to the inputs.conf file and modify it for your netflow index, for example:
1
[udp://10514]
2
sourcetype = flowintegrator
3
index = flowintegrator
Copied!
Configuring Universal Forwarder with syslog-ng or rsyslog
In this scenario syslog-ng or rsyslog are configured to listen to syslogs sent by NFO on a UDP port 10514. Syslog-ng or rsyslog are usually writing the logs into configurable directories. In this example we assume that those are written to /var/log/netflow. 
Add the following lines to inputs.conf file and modify it for your netflow index, for example:
1
[monitor:///var/log/netflow]
2
sourcetype = flowintegrator
3
index = flowintegrator
Copied!
It is very important to set sourcetype=flowintegrator and to point it to the index where NetFlow Analytics for Splunk App and Add-on are expecting it.
Configure Universal Forwarder Output (Target Indexers)
During the installation of the Universal Forwarders, a Receiving Indexer can be configured, as it can be seen here:
It is an optional step during the installation. If it was not configured or if load balancing is required, additional Receiving Indexers can be added later by adding to the %SPLUNK_HOME%/etc/system/local/outputs.conf file:
1
[tcpout]
2
defaultGroup = default-autolb-group
3
​
4
[tcpout:default-autolb-group]
5
server = 10.1.0.100:9997,10.1.0.101:9997
Copied!
More info about load balancing: 
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setuploadbalancingd#How_load_balancing_works​
NetFlow Analytics for Splunk App Dashboards for AWS Cloud 
AWS Traffic Overview Dashboard
AWS Traffic Overview Accepts-Rejects
AWS Traffic by Source EC2 Instance
AWS Traffic by Destination EC2 Instance
AWS Traffic by Protocol and Port
AWS Traffic by Protocol
AWS Traffic by VPC
AWS Traffic by Region
Configure NFO GCP VPC Flow Logs Modules
Next - Solutions
NetFlow-based DDoS Detection
Last modified 1yr ago
Copy link
Contents
Installing into a Single Splunk Server
Installing into a Distributed Splunk Environment
NetFlow Analytics for Splunk App Dashboards for AWS Cloud