Configure targeted packet capture

To collect full network packets using targeted packet capture, map your Splunk Stream deployment to a remote file server. Splunk Stream Forwarder uses the file server to store PCAP files that it generates based on packet stream definitions. For more information, see Configure packet streams in the Splunk Stream User Manual.

Map deployment to remote file server

To configure targeted packet capture, you map your Splunk Stream deployment to a remote file server. Before you create new packet streams in the Splunk App for Stream, configure your Stream forwarder and the Splunk Independent Stream Forwarder deployments for targeted packet capture.

1. Set up and mount the file server

1. Make sure you have an NFS (or similar) file server volume. To create one, see Set up a NFS server.
2. On the host machine running the streamfwd binary, mount your file server volume.

2. Add file server parameters to streamfwd.conf

1. In $SPLUNK_HOME/etc/apps/Splunk_TA_stream/ open local/streamfwd.conf.
2. Add the server information to the [streamfwd] stanza:

fileServerId = <value>
fileServerMountPoint = <value>

For example:

[streamfwd]
fileServerId = nfs://192.168.6.1/packetcaptures
fileServerMountPoint = /usr/local/packetcaptures

3. Restart Splunk.

3. Mount the file server on your search head

On the search head running splunk_app_stream, create a mount point. For more information, see Setting up a NFS client.

4. Configure a mount point for the file server

1. In the Splunk App for Stream UI, click Configuration > File Server Mount Points.
2. Click Add File Server.
3. Specify the File Server and Mount Point.
4. Click Create.

Create new packet streams

After mapping your Splunk Stream deployment to your remote file server, you are ready to create new packets streams and collect full network packets using targeted packet capture.

1. In the Splunk App for Stream, click Configuration > Configure Streams.
2. Click New Stream > Packet Stream.
3. Follow the steps in the workflow wizard to configure your packet stream. For detailed instructions, see Configure packet streams.