The Splunk App for Stream is a scalable and easy-to-configure software solution that captures real-time streaming wire data from anywhere in your datacenter or from any public Cloud infrastructure.
Benefit from this new class of data in Splunk and correlate it with logs, events and metrics to enhance Operational Intelligence across a variety of use cases.
Capture only the relevant wire data for analytics, through filters and aggregation rules. Manage wire data volumes with fine-grained precision by selecting or deselecting protocols and associated attributes within the App interface.
Rapidly deploy wire data collection, from the App interface, to gain real time network visibility that is otherwise unavailable from cloud implementations and hard to achieve with traditional datacenters. Respond quickly to any issue with a simple interface-driven installation, centralized deployment and configuration across IT environments of all sizes.
Splunk App for Stream lets you:
• Capture wire data across distributed infrastructures, from the network perimeter and endpoints in public, private or hybrid clouds using a single software solution
• Control and manage wire data volumes with fine-grained precision by selecting or deselecting protocols and associated attributes within the app interface
• Clone built-in streams, and define filters and aggregation rules to capture meaningful data for analyses
• Create ephemeral streams to capture data over specific time intervals for pinpoint analysis(in conjunction with supported Splunk apps).
• Whitelist or blacklist data capture from specific IP addresses and subnets with the interface
• Decrypt SSL-encrypted traffic with RSA keys for data completeness
• Scale the installation and configuration with interface-driven installation and centralized management
• Correlate application and infrastructure data such as logs, events and metrics with wire data to gain valuable insights and enhance operational intelligence
Access the free Streams Examples App that contains searches, examples and instructions on how to enable several use cases using Splunk App for Stream. The Streams examples App covers different scenarios like looking for security relevant conversations, looking at a Web Shopping Cart for funnel analysis, using full payload data to track Shopping Cart revenue, analyzing SIP conversations, looking at Application and Database performance metrics, and more.
The Splunk App for Stream download package installs the following components:
- Splunk Stream Add-on (Splunk_TA_stream): Splunk_TA_stream captures wire event data, and sends that data to Splunk Enterprise. The Splunk_TA_stream includes the Stream Forwarder (streamfwd) binary, which provides a new "Wire Data" Modular Input type for Splunk Enterprise.
The Stream Forwarder passively extracts wire data from network devices, and runs a modular input that sends event data to STDOUT using XML streaming mode. All captured events have "source=stream:stream-id" and "sourcetype=stream:protocol", where ID is typically the name of a protocol. For example, "sourcetype=stream:http."
- Splunk App for Stream (splunk_app_stream): splunk_app_stream provides configuration management for the Stream Forwarder. You can configure the Stream Forwarder to capture event data from multiple network protocols. See Supported Protocols.
The app also lets you monitor key network and processor metrics in built-in dashboards, which make it easy to identify spikes, trends, and anomalies in network activities. Click on any point in a graph to drill down to Splunk Search level for that specific time range of events.
Install Splunk App for Stream
- Click Download on this page. The splunk_app_stream tar.gz installer file downloads to your computer.
- Log into Splunk Web.
- Click Apps > Manage Apps.
- Click Install App from File.
- Upload the splunk_app_stream tar.gz installer file.
- Restart Splunk.
Enable Stream Forwarder data input
Important: You must be running splunkd with "root" privileges to enable the streamfwd process to capture data. (Go to $SPLUNK_HOME/bin. Issue the command: sudo ./splunk restart)
- Go to Settings > Data Inputs
- Click on "Wire Data".
- A Stream Forwarder data input appears in the list. Click Enable.
The Stream Forwarder starts to capture and send wire data to Splunk.
The Splunk App for Stream version 6.3.2 is compatible with Splunk Enterprise 6.0.x or later.
For detailed installation instructions, see Install Splunk App for Stream.
For detailed Splunk App for Stream documentation, see Splunk App for Stream documentation