Splunk Stream

Installation and Configuration Manual

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of Splunk Stream. Click here for the latest version.
Acrobat logo Download topic as PDF

Configure file extraction

To use file extraction, you must map your Splunk Stream deployment to a remote file server. Stream forwarder uses the file server to store extracted files based on the metadata stream definition. For more information, see Use file extraction in the Splunk Stream User Manual.

Map deployment to remote file server

Before you configure file extraction for a metadata stream in splunk_app_stream, complete the following configuration steps:

1. Set up and mount file server

  1. If necessary, create a NFS (or similar) file server volume. For more information, see Set up a NFS server.
  2. On the host machine running the streamfwd binary, mount the file server volume. (This applies to both Splunk_TA_stream and independent Stream forwarder deployments.)

2. Add file server parameters to streamfwd.conf

  1. Edit local/streamfwd.conf
  2. Add the following parameters to the [streamfwd] stanza:
    fileServerId = <value>
    fileServerMountPoint = <value>

    For example:

    fileServerId =
    fileServerMountPoint = /streamload
  3. Restart Splunk.

3. Mount file server on search head

On the search head running splunk_app_stream, create a mount point. For more information, see Setting up an NFS client.

4. Configure mount point for file server

  1. In the splunk_app_stream UI, click Configuration > File Server Mount Points.
  2. Click Add File Server.
  3. Specify the File Server and Mount Point. Click Create.
    Mount point search head.png

    The mount point that you specify in the splunk_app_stream UI on the search head differs from the mount point that you specify in streamfwd.conf.

Use file extraction

After mapping your Splunk Stream deployment to your remote file server, you are ready to configure file extraction for your metadata streams. For detailed instructions, see Use file extraction in the Splunk Stream User Manual.

Last modified on 01 April, 2020
Configure Stream forwarder
Configure targeted packet capture

This documentation applies to the following versions of Splunk Stream: 7.1.2, 7.1.3, 7.2.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters