Splunk Stream version 7.4.0 was released on August 12, 2021.
The 7.4.0 release of Stream provides
- Added support for decoding IEEE 802.1q and IEEE 802.1ad.
- When multi tag VLANs are decoded, the innermost VLAN tag is placed in the
vlan_idfield and the outer VLAN tags are put in
vlan_tagsfield for supported protocol events.
This documentation applies to the following versions of Splunk Stream™: 7.4.0