Configure stream on a forwarder:
I installed stream app on Splunk HF and indexer, I want to send my routers netflow logs to indexer, I run set_permissions.sh on both of them and configure my streamfwd.conf on HF like this:
[
streamfwd]
logConfig = streamfwdlog.conf
port = 8889
netflowReceiver.0.ip = HF_ip
netflowReceiver.0.port = 9995
netflowReceiver.0.decoder = netflow
And on Indexer
[streamfwd]
logConfig = streamfwdlog.conf
port = 8889
netflowReceiver.0.ip = Indexer_ip
netflowReceiver.0.port = 9995
netflowReceiver.0.decoder = netflow
I configure my routers to send netflow logs to my HF port 9995
but I don't receive any logs from my routers.
Can you tell me what is my problem?
↧