Simple Transport
Splunk App for Stream supports capture of these Simple Transport protocols on Linux, Mac, and Windows. For more information see Configure Streams in the Splunk App for Stream User Manual.
ARP
Address Resolution Protocol RFC826
Name | Description | Term |
---|---|---|
src_ip | Source IP Address | flow.c-ip |
src_mac | Source MAC address in hexadecimal format | flow.c-mac |
network_interface | Name of network interface | flow.interface-name |
capture_hostname | Hostname where Flow was captured | flow.hostname |
vlan_id | VLAN ID from 802.1Q. In a header with multiple vlan tags, vlan_id is the outermost tag | flow.vlan-id |
vlad_tags | All VLAN tags collected from 802.1Q and 802.1ad headers. | flow.vlan-tags |
dest_ip | Destination IP Address | flow.s-ip |
dest_mac | Destination MAC address in hexadecimal format | flow.s-mac |
bytes_in | The number of bytes sent from client to server | flow.cs-bytes |
packets_in | The total number of packets sent from client to server | flow.cs-packets |
flow_id | Flow ID | flow.flow-id |
protocol_stack | Protocol stack of Flow | flow.protocol-stack |
opcode | Operation code, Request = 1, Response = 2 | arp.opcode |
protocol_type | Protocol number in the ARP message | arp.protocol-type |
protocol_size | Size in bytes of the logical address requested | arp.protocol-size |
hardware_type | Hardware type for which the request is sent | arp.hardware-type |
hardware_size | Hardware (Mac) address length | arp.hardware-size |
arp_src_mac | ARP sender MAC address in hexadecimal format in ARP packet header | arp.src-mac |
arp_dest_mac | ARP destination MAC address, in hexadecimal format, in ARP packet header | arp.dest-mac |
IP
Internet Protocol RFC 791
Name | Description | Term |
---|---|---|
bytes | The total number of bytes transferred | flow.bytes |
src_ip | Client IP Address | flow.c-ip |
src_mac | Client packets MAC address in hexadecimal format | flow.c-mac |
bytes_in | The number of bytes sent from client to server | flow.cs-bytes |
src_content | All raw payload content sent from client to server | flow.cs-content |
packets_in | The total number of packets sent from client to server | flow.cs-packets |
network_interface | Name of network interface | flow.interface-name |
capture_hostname | Hostname where Flow was captured | flow.hostname |
protoid | Upper layer protocol | ip.protoid |
app | Layer 4 protocol name | flow.protocol |
dest_ip | Server IP Address | flow.s-ip |
dest_mac | Server packets MAC address in hexadecimal format | flow.s-mac |
bytes_out | The number of bytes sent from server to client | flow.sc-bytes |
dest_content | All raw payload content sent from server to client | flow.sc-content |
packets_out | The total number of packets sent from server to client | flow.sc-packets |
version | IP version | ip.version |
tos | Type of Service | ip.tos |
TCP
Transmission Control Protocol RFC 793
Name | Description | Term |
---|---|---|
src_ip | Client IP Address | flow.c-ip |
dest_ip | Server IP Address | flow.s-ip |
src_port | Client port number | flow.c-port |
dest_port | Server port number | flow.s-port |
src_mac | Client packets MAC address in hexadecimal format | flow.c-mac |
dest_mac | Server packets MAC address in hexadecimal format | flow.s-mac |
packets_in | The total number of packets sent from client to server | flow.cs-packets |
packets_out | The total number of packets sent from server to client | flow.sc-packets |
ack_packets_in | The number of acknowledgement packets sent from client to server | flow.cs-ack-packets |
ack_packets_out | The number of acknowledgement packets sent from server to client | flow.sc-ack-packets |
missing_packets_in | The number of missing packet gaps detected within the request | flow.cs-missing-packets |
missing_packets_out | The number of missing packet gaps detected within the response | flow.sc-missing-packets |
duplicate_packets_in | The number of duplicate packets sent from client to server | flow.cs-duplicate-packets |
duplicate_packets_out | The number of duplicate packets sent from server to client | flow.sc-duplicate-packets |
data_packets_in | The number of data packets sent from client to server | flow.cs-data-packets |
data_packets_out | The number of data packets sent from server to client | flow.sc-data-packets |
bytes_in | The number of bytes sent from client to server | flow.cs-bytes |
bytes_out | The number of bytes sent from server to client | flow.sc-bytes |
bytes | The total number of bytes transferred | flow.bytes |
time_taken | Number of microseconds, from the end user perspective, that it took to complete a flow event | flow.time-taken |
request_time | Number of microseconds that it took the client to send a request | flow.cs-send-time |
request_ack_time | Number of microseconds it took the server to acknowledge receipt of the request | flow.cs-ack-time |
reply_time | Number of microseconds it took the server to start replying to a request | flow.sc-reply-time |
response_time | Number of microseconds it took the server to send a response | flow.sc-send-time |
response_ack_time | Number of microseconds it took the client to acknowledge receipt of the response | flow.sc-ack-time |
ssl_time | Number of microseconds it took to negotiate an SSL handshake | flow.ssl-time |
ssl_version | SSL protocol version used for encryption; undefined if not encrypted | flow.ssl-version |
ssl_session_id | SSL session ID | flow.ssl-session-id |
ssl_cert_md5 | md5 of SSL certificate | flow.ssl-cert-md5 |
ssl_commonname | Common name with domain name of subject in SSL certificate | flow.ssl-cert-subject-commonname |
ssl_orgname | Organization name of subject in SSL certificate | flow.ssl-cert-subject-orgname |
ssl_issuer | Organization name of issuer in SSL certificate | flow.ssl-cert-issuer-orgname |
ssl_serialnumber | Serial number of SSL certificate | flow.ssl-cert-serialnumber |
ssl_validity_end | SSL certifiate validity end date | flow.ssl-cert-validity-not-after |
ssl_validity_start | SSL certifiate validity start date | flow.ssl-cert-validity-not-before |
data_center_time | Number of microseconds from the last request packet to the last response packet | flow.data-center-time |
client_rtt | Average round trip time, in microseconds, from the client to the point of capture | flow.cp-rtt |
server_rtt | Average round trip time, in microseconds, from the server to the point of capture | flow.ps-rtt |
client_rtt_sum | Sum of all round trip time measurements from the client to the point of capture | flow.cp-rtt-sum |
server_rtt_sum | Sum of all round trip time measurements from the server to the point of capture | flow.ps-rtt-sum |
client_rtt_packets | Number of round trip measurements from the client to the point of capture | flow.cp-rtt-packets |
server_rtt_packets | Number of round trip measurements from the server to the point of capture | flow.ps-rtt-packets |
refused | Number of requests that were refused by the server | flow.refused |
canceled | Number of HTTP responses that were canceled early by the client | flow.canceled |
connection | TCP session server endpoint (IP address and TCP port) | flow.connection |
tcp_status | TCP handshake status (0=OK, 1=RESET, 2=IGNORED) | flow.tcp-status |
protocol | Level 7 protocol name (http, ftp, etc.) | flow.protocol |
transport | Transport layer protocol (udp or tcp) | flow.transport |
UDP
User Datagram Protocol RFC 768
Name | Description | Term |
---|---|---|
src_ip | Client IP Address | flow.c-ip |
dest_ip | Server IP Address | flow.s-ip |
src_port | Client port number | flow.c-port |
dest_port | Server port number | flow.s-port |
src_mac | Client packets MAC address in hexadecimal format | flow.c-mac |
dest_mac | Server packets MAC address in hexadecimal format | flow.s-mac |
packets_in | The total number of packets sent from client to server | flow.cs-packets |
packets_out | The total number of packets sent from server to client | flow.sc-packets |
bytes_in | The number of bytes sent from client to server | flow.cs-bytes |
bytes_out | The number of bytes sent from server to client | flow.sc-bytes |
bytes | The total number of bytes transferred | flow.bytes |
time_taken | Number of microseconds, from the end user perspective, that it took to complete a flow event | flow.time-taken |
protocol | Level 7 protocol name (http, ftp, etc.) | flow.protocol |
transport | Transport layer protocol (udp or tcp) | flow.transport |
Messaging | Streaming Media |
This documentation applies to the following versions of Splunk Stream™: 7.4.0, 8.0.0
Feedback submitted, thanks!