Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Savvius for Splunk Dashboards
MD5 checksum (savvius-for-splunk-dashboards_2012.tgz) 16fed2552a3018d5cc4b0e8287e45585 MD5 checksum (savvius-for-splunk-dashboards_105.tgz) f3e78ec074239a726129ba1fea8ba978 MD5 checksum (savvius-for-splunk-dashboards_104.tgz) 7e0434c54a7c088ef4293b979859bfc2 MD5 checksum (savvius-for-splunk-dashboards_103.tgz) 85c1e8934b9e49d5437a3872ab9b8692 MD5 checksum (savvius-for-splunk-dashboards_102.tgz) 9c3c9514b2a7b921ffb27135adde9ccf MD5 checksum (savvius-for-splunk-dashboards_10.tgz) fcf9cfd17d7617062b09e40141a0d80a
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Savvius for Splunk Dashboards

Splunk Certified
Overview
Details
When you need complete visibility into your network from the core to the edges, Savvius (formerly WildPackets) offers a range of network appliances in hardware and software form that provide real-time monitoring and high speed capture to disk of wired and wireless network traffic.

Savvius Omnipliances integrate with Splunk through the Savvius Network Dashboards for Splunk. Together, Omnipliances and Splunk provide a long term monitoring and reporting solution. With the Savvius for Splunk App, statistics and events from any number of Capture Engines can be viewed in Splunk dashboards as an aggregated set or individually. Within the dashboards, any range of time can be chosen, and statistics and events from different times can be compared.

More information about the Savvius Omnipliance and OmniPeek Capture Engines can be found here:

https://www.savvius.com/products/all_products

Important note: This app only contains dashboards and reports. No data is collected by this app. For Capture Engine data collection, install and configure the separate TA-Savvius-nix or TA-Savvius-win technology add-on.

Table of Contents

OVERVIEW

  • About the Savvius for Splunk Network Dashboards
  • Release notes
  • Support and resources

INSTALLATION

  • Hardware and software requirements
  • Installation steps

OVERVIEW

About the Savvius for Splunk Network Dashboards

  • Author: Savvius
  • App Version: 1.0
  • Vendor Products: Omnipliance (CX/MX/TL) and OmniPeek Capture Engines
  • Has index-time operations: true, this app must be placed on indexers
  • Create an index: true, impacts disk storage
  • Implements summarization: false

Introduction

The Savvius for Splunk App is a long term monitoring and reporting solution for Savvius Omnipliances and OmniPeek Capture Engines. With the Savvius for Splunk App, many different kinds of network and application statistics and hundreds of different types of events events from one or more Capture Engines can be viewed in dashboards as an aggregated set or individually. Within the dashboards, any range of time can be chosen, and statistics and events from different times can be compared.

Although we believe the dashboards provided are useful, we look at them as a starting point, and users are encouraged to customize, enhance, and clone the dashboards to create their own. The wealth of statistics and events from Capture Engines can also be correlated with other data in completely different dashboards. This is when the insight happens about how the network affects other aspects of the business, and vice versa.

The Savvius for Splunk App does require either an Omnipliance (CX,MX,TL), which are rack mounted 1U and 3U servers, or an OmniPeek Capture Engine for Windows, which is software you can install and run on your own windows machine.

An evaluation version of the OmniPeek Capture Engine for Windows can be found here:

http://www.wildpackets.com/product_trials

Components

The Savvius for Splunk App builds on the ability of the Capture Engine to output events and statistics as CSV files at specified intervals, and have them ingested into a Splunk Server. The Savvius for Splunk solution consists of a Capture Engine and a Splunk Server.

On the machine running the capture engine there is a Splunk Forwarder and a Savvius Technology Add-on (TA). The Splunk Forwarder is a utility available for Windows and Linux that is offered for free by Splunk. The Splunk Forwarder forwards data from the Capture Engine to the Splunk Server. The Capture Engine and the Splunk Forwarder are always installed onto the same machine. The TA is the package that tells the Splunk Forwarder where to find the CSV files, and what to do with them. There are 2 TA’s, one for Windows and one Linux. Both TA’s are on Splunkbase, and the SplunkForwarder is on the Splunk website.

The Savvius for Splunk App installed into a Splunk Server. The Splunk Server can be installed onto the same machine as the Capture Engine, but it is recommend to run the Splunk Server on a different machine. The Splunk Server is also offered is a cloud service called Splunk Cloud, so the Savvius for Splunk Dashboards can be installed in the cloud as well.

Splunk Forwarder and Savvius Technology Add-ons

The Splunk Forwarder and the Splunk Server index the CSV reports generated by a Capture Engine. In order to generate CSV reports that the SplunkForwarder will find, the capture must be named “Splunk”, and both Analysis Options and Statistics Output have to be enabled. Setting up the Splunk Forwarder to index the CSV files is described below for both Windows and Linux. The only difference between Windows and Linux is which TA package to use.

Linux TA - https://splunkbase.splunk.com/app/2746/
Windows TA - https://splunkbase.splunk.com/app/2747/

Splunk Server

The Splunk Server indexes the data coming from the Capture Engines, and stores the data. The data from each of the CSV files is stored into a different custom index. For example, the protocol statistics are stored in the index called “sv_protocols”, and the nodes statistics are stored in the index called “sv_nodes”, and the flows are in “sv_flows”, and so on. This makes it possible to display the data for a particular index by typing “index=nodes” or “index=protocols” into the Splunk search field.

Warning: The creation and growth of these indexes will use disk space.

Savvius for Splunk App

The Savvius for Splunk App provides dashboards in the Splunk UI that display network statistics from one or more Capture Engines. There are high level dashboards like the Network Dashboard, Security Dashboard, and VOIP Dashboard, which display trends about the network and the events taking place on it. There are also lower level dashboards that display list of network activity like nodes, flows, and protocols. All of the dashboards are completely web-based and can be customized and extended in many ways.

Splunk Licensing

The Splunk license pricing model is usage based. The free license allows up to 500MBs per day of data to be indexed. More data can be indexed by purchasing a license. Splunk offers perpetual licenses and a term license. More on Splunk licenses can be found here: https://www.splunk.com/en_us/products/pricing.html.

Scripts and binaries

none

Release notes

none

About this release

Version 1.0 of the Savvius for Splunk Network Dashboards is compatible with:

  • Splunk Enterprise versions: 6.2 and above
  • CIM: n/a
  • Platforms: Platform independent
  • Vendor Products: Omnipliance (CX/MX/TL) and OmniPeek Capture Engines 9.0 and above
  • Lookup file changes: n/a
Third-party software attributions

Version 1.0 of the Savvius for Splunk Network Dashboards incorporates the following third-party software or libraries.

The timewrap app is used to implement the "compare" dashboards in the Savvius for Splunk App.

Support and resources

The Savvius for Splunk Network Dashboards are supported by Savvius for customers who have purchased maintenance with their Savvius products.

INSTALLATION AND CONFIGURATION

Hardware and software requirements

Hardware requirements

Savvius for Splunk supports the following server platforms in the versions supported by Splunk Enterprise:

  • Windows
  • Linux

Software requirements

To function properly, Savvius for Splunk requires the following software:

Splunk Enterprise system requirements

Because this add-on runs on Splunk Enterprise, all of the Splunk Enterprise system requirements apply.

Download

Download the Savvius for Splunk Network Dashboards at https://splunkbase.splunk.com/app/2730

Installation steps

Savvius for Splunk App Installation Instructions

This document provides instructions on how to set up the Savvius for Splunk integration.

Savvius Splunk Dashboard Installation Instructions

  1. Download and install Splunk Enterprise from the Splunk website
  2. Download the timewrap App from splunkbase: https://apps.splunk.com/app/1645/
  3. Download the SavviusForSplunk App from Splunkbase. The actual filename will contain the version number and end in .spl
  4. Install both apps by clicking on the gear icon next to the “Apps” label on the main Splunk page
  5. Restart Splunk

How to Receive Data

To receive data from an Omnipliance (Linux) or an OmniPeek Capture Engine (Windows) download either the TA-Savvius-nix or TA-Savvius-win and follow the installations in the documentation tab for those downloads.

Splunk Dashboard Usage

Once the Savvius for Splunk App has been installed into the Splunk Server, it will appear on the Splunk Home page as “Savvius for Splunk”. Select this entry, and then select the Dashboards entry on the next page.

There are 4 different categories of dashboards

  1. Dashboard – high level network trends like utilization and events
  2. List – lists of network statistics like nodes and protocols
  3. Response Time - latency
  4. Compare – comparing days, weeks, and months
    (the compare dashboards depend on the timewrap app: https://apps.splunk.com/app/1645/)

Release Notes

Version 2.0.12
Jan. 5, 2016

New Release

Version 1.0.5
June 19, 2015

Important Note: This release is incompatible with all previous releases. But it's worth it. We have removed the creation and use of indexes by the app, and are using sourcetype instead.
- Changed default time to last 1 hour.

Version 1.0.4
May 27, 2015

- removed local.meta
- added documentation on indexes

Version 1.0.3
May 19, 2015

Changed icon to red V

Version 1.0.2
May 19, 2015

Fixed known issues necessary for certification

Version 1.0
May 4, 2015

18
Installs
643
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

Splunk Certification Program

Splunk's App Certification program uses a specific set of criteria to evaluate the level of quality, usability and security your app offers to its users. In addition, we evaluate the documentation and support you offer to your app's users.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2017 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.