Configure targeted packet capture
To collect full network packets using targeted packet capture, you must map your Splunk Stream deployment to a remote file server. Stream forwarder uses the file server to store pcap files that it generates based on packet stream definitions. For more information, see Configure packet streams in the Spunk Stream User Manual.
Map deployment to remote file server
Targeted packet capture requires mapping of your Splunk Stream deployment to a remote file server. Before you create new packet streams in
splunk_app_stream, complete the following configuration steps:
1. Set up and mount file server
- If necessary, create a NFS (or similar) file server volume. For more information, see Set up a NFS server.
- On the host machine running the
streamfwdbinary, mount the file server volume. (This applies to both Splunk_TA_stream and indpenedent Stream forwarder deployments.)
2. Add file server parameters to streamfwd.conf
- Add the following parameters to the
fileServerId = <value> fileServerMountPoint = <value>
[streamfwd] fileServerId = nfs://192.168.6.1/packetcaptures fileServerMountPoint = /usr/local/packetcaptures
- Restart Splunk.
3. Mount file server on search head
On the search head running
splunk_app_stream, create a mount point. For more information, see Setting up a NFS client.
4. Configure mount point for file server
- In the
splunk_app_streamUI, click Configuration > File Server Mount Points.
- Click Add File Server.
- Specify the File Server and Mount Point. Click Create.
Create new packet streams
After mapping your Splunk Stream deployment to your remote file server, you are ready to create new packets streams and collect full network packets using targeted packet capture.
splunk_app_stream, click Configuration > Configure Streams.
- Click New Stream > Packet Stream.
- Follow the steps in the workflow wizard to configure your packet stream. For detailed instructions, see Configure packet streams.
Configure file extraction
Configure Flow collector
This documentation applies to the following versions of Splunk Stream™: 7.1.0, 7.1.1
Feedback submitted, thanks!