sFlow Analyzer for Splunk

sFlow Analyzer for Splunk collects and decodes sFlow samples using Wireshark. It is designed to provide visibility into VXLAN overlay traffic. A JSON-formatted event is generated for each sample with all decoded header fields. Any sFlow-capable switch can be used as a packet sniffer and sampled data can be decoded and indexed remotely. sFlow samples are UDP-encapsulated and can easily traverse L3 boundaries. sFlow Analyzer for Splunk includes a dashboard which enriches sampled data with DNS, ethertype, IP protocol and TCP/UDP port lookups to generate top talker, destination and application charts. The sFlow Analyzer for Splunk dashboard has a radio button allowing users to choose how they want to visualize stats: underlay or VXLAN overlay. When VXLAN overlay is selected, all top talker, destination and application charts will show VXLAN overlay hosts and applications.