icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading LiveAction for Splunk Dashboards
SHA256 checksum (liveaction-for-splunk-dashboards_2012.tgz) e0605afab628f36fa527f3b65fd29028b9d2f378c09328304357114aaea1f930 SHA256 checksum (liveaction-for-splunk-dashboards_105.tgz) c45bee90bb24d3c4c8964cb2fe33918d3eaf13fd3b0009a290d5c90ea5e53e94 SHA256 checksum (liveaction-for-splunk-dashboards_104.tgz) 6e8f0e26bd774a473a9b5f0ed9f1e97d0f29109dc227e19cf89d1b1ab5a3d639 SHA256 checksum (liveaction-for-splunk-dashboards_103.tgz) fab70c28e5686b8fee3316bce8a61daf023d91ec0fd37f67ac3b85fbf3318cfd SHA256 checksum (liveaction-for-splunk-dashboards_102.tgz) e12a18806a6e0301ee5ea818364c714a3b95d98fc7b6ffdf94ac9445d4380b83 SHA256 checksum (liveaction-for-splunk-dashboards_10.tgz) c8c78e3a5052c229fe6d7a641a017b66bbe6f865b3e475ce61a68fba34df9610
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

LiveAction for Splunk Dashboards

This app has been archived. Learn more about app archiving.
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
When you need complete visibility into your network from the core to the edges, LiveAction offers a range of network appliances in hardware and software form that provide real-time monitoring and high speed capture to disk of wired and wireless network traffic.

LiveAction LiveWire integrates with Splunk through the LiveAction Network Dashboards for Splunk. Together, LiveWire and Splunk provide a long term monitoring and reporting solution. With the LiveAction for Splunk App, statistics and events from any number of Capture Engines can be viewed in Splunk dashboards as an aggregated set or individually. Within the dashboards, any range of time can be chosen, and statistics and events from different times can be compared.

More information about LiveAction LiveWire and OmniPeek can be found here:


Important note: This app only contains dashboards and reports. No data is collected by this app. For Capture Engine data collection, install and configure the separate TA-Savvius-nix or TA-Savvius-win technology add-on.

Table of Contents


  • About the Savvius for Splunk Network Dashboards
  • Release notes
  • Support and resources


  • Hardware and software requirements
  • Installation steps


About the Savvius for Splunk Network Dashboards

  • Author: LiveAction
  • App Version: 1.0
  • Vendor Products: LiveWire Appliance
  • Has index-time operations: true, this app must be placed on indexers
  • Create an index: true, impacts disk storage
  • Implements summarization: false


The LiveAction for Splunk App is a long term monitoring and reporting solution for LiveAction LiveWire. With the LiveAction for Splunk App, many different kinds of network and application statistics and hundreds of different types of events events from one or more Capture Engines can be viewed in dashboards as an aggregated set or individually. Within the dashboards, any range of time can be chosen, and statistics and events from different times can be compared.

Although we believe the dashboards provided are useful, we look at them as a starting point, and users are encouraged to customize, enhance, and clone the dashboards to create their own. The wealth of statistics and events from Capture Engines can also be correlated with other data in completely different dashboards. This is when the insight happens about how the network affects other aspects of the business, and vice versa.

The LiveAction for Splunk App does require a physical of virtual LiveWire server.


The LiveAction for Splunk App builds on the ability of the Capture Engine to output events and statistics as CSV files at specified intervals, and have them ingested into a Splunk Server. The LiveAction for Splunk solution consists of a Capture Engine and a Splunk Server.

On the machine running the capture engine there is a Splunk Forwarder and a Savvius Technology Add-on (TA). The Splunk Forwarder is a utility available for Windows and Linux that is offered for free by Splunk. The Splunk Forwarder forwards data from the Capture Engine to the Splunk Server. The Capture Engine and the Splunk Forwarder are always installed onto the same machine. The TA is the package that tells the Splunk Forwarder where to find the CSV files, and what to do with them. There are 2 TA’s, one for Windows and one Linux. Both TA’s are on Splunkbase, and the SplunkForwarder is on the Splunk website.

The LiveAction for Splunk App installed into a Splunk Server. The Splunk Server can be installed onto the same machine as the Capture Engine, but it is recommend to run the Splunk Server on a different machine. The Splunk Server is also offered is a cloud service called Splunk Cloud, so the LiveAction for Splunk Dashboards can be installed in the cloud as well.

Splunk Forwarder and LiveAction Technology Add-ons

The Splunk Forwarder and the Splunk Server index the CSV reports generated by a Capture Engine. In order to generate CSV reports that the SplunkForwarder will find, the capture must be named “Splunk”, and both Analysis Options and Statistics Output have to be enabled. Setting up the Splunk Forwarder to index the CSV files is described below for both Windows and Linux. The only difference between Windows and Linux is which TA package to use.

Linux TA - https://splunkbase.splunk.com/app/2746/
Windows TA - https://splunkbase.splunk.com/app/2747/

Splunk Server

The Splunk Server indexes the data coming from the Capture Engines, and stores the data. The data from each of the CSV files is stored into a different custom index. For example, the protocol statistics are stored in the index called “sv_protocols”, and the nodes statistics are stored in the index called “sv_nodes”, and the flows are in “sv_flows”, and so on. This makes it possible to display the data for a particular index by typing “index=nodes” or “index=protocols” into the Splunk search field.

Warning: The creation and growth of these indexes will use disk space.

Savvius for Splunk App

The Savvius for Splunk App provides dashboards in the Splunk UI that display network statistics from one or more Capture Engines. There are high level dashboards like the Network Dashboard, Security Dashboard, and VOIP Dashboard, which display trends about the network and the events taking place on it. There are also lower level dashboards that display list of network activity like nodes, flows, and protocols. All of the dashboards are completely web-based and can be customized and extended in many ways.

Splunk Licensing

The Splunk license pricing model is usage based. The free license allows up to 500MBs per day of data to be indexed. More data can be indexed by purchasing a license. Splunk offers perpetual licenses and a term license. More on Splunk licenses can be found here: https://www.splunk.com/en_us/products/pricing.html.

Scripts and binaries


Release notes


About this release

Version 1.0 of the LiveAction for Splunk Network Dashboards is compatible with:

  • Splunk Enterprise versions: 6.2 and above
  • CIM: n/a
  • Platforms: Platform independent
  • Vendor Products: Omnipliance (CX/MX/TL) and OmniPeek Capture Engines 9.0 and above
  • Lookup file changes: n/a
Third-party software attributions

Version 1.0 of the LiveAction for Splunk Network Dashboards incorporates the following third-party software or libraries.

The timewrap app is used to implement the "compare" dashboards in the Savvius for Splunk App.

Support and resources

The LiveAction for Splunk Network Dashboards are supported by Savvius for customers who have purchased maintenance with their Savvius products.


Hardware and software requirements

Hardware requirements

LiveAction for Splunk supports the following server platforms in the versions supported by Splunk Enterprise:

  • Windows
  • Linux

Software requirements

To function properly, Savvius for Splunk requires the following software:

Splunk Enterprise system requirements

Because this add-on runs on Splunk Enterprise, all of the Splunk Enterprise system requirements apply.


Download the Savvius for Splunk Network Dashboards at https://splunkbase.splunk.com/app/2730

Installation steps

LiveAction for Splunk App Installation Instructions

This document provides instructions on how to set up the Savvius for Splunk integration.

LiveAction Splunk Dashboard Installation Instructions

  1. Download and install Splunk Enterprise from the Splunk website
  2. Download the timewrap App from splunkbase: https://apps.splunk.com/app/1645/
  3. Download the SavviusForSplunk App from Splunkbase. The actual filename will contain the version number and end in .spl
  4. Install both apps by clicking on the gear icon next to the “Apps” label on the main Splunk page
  5. Restart Splunk

How to Receive Data

To receive data from a LiveWire (Linux) or an OmniPeek Capture Engine (Windows) download either the TA-Savvius-nix or TA-Savvius-win and follow the installations in the documentation tab for those downloads.

LiveAction Dashboard Usage

Once the LiveAction for Splunk App has been installed into the Splunk Server, it will appear on the Splunk Home page as “Savvius for Splunk”. Select this entry, and then select the Dashboards entry on the next page.

There are 4 different categories of dashboards

  1. Dashboard – high level network trends like utilization and events
  2. List – lists of network statistics like nodes and protocols
  3. Response Time - latency
  4. Compare – comparing days, weeks, and months
    (the compare dashboards depend on the timewrap app: https://apps.splunk.com/app/1645/)

Release Notes

Version 2.0.12
Jan. 5, 2016

New Release

Version 1.0.5
June 19, 2015

Important Note: This release is incompatible with all previous releases. But it's worth it. We have removed the creation and use of indexes by the app, and are using sourcetype instead.
- Changed default time to last 1 hour.

Version 1.0.4
May 27, 2015

- removed local.meta
- added documentation on indexes

Version 1.0.3
May 19, 2015

Changed icon to red V

Version 1.0.2
May 19, 2015

Fixed known issues necessary for certification

Version 1.0
May 4, 2015


Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.