The PCAP Analyzer for Splunk includes useful Dashboards to analyze network packet capture files from Wireshark or Network Monitor (.pcap) and network streaming data (Splunk App for Stream). The App includes Dashboards which will show you: - The Top Talker IP's, Protocols, VLANs, Conversations - Detailed overview about IP Conversations, Packet Loss, TCP Error's, Round Trip Time - Conversation Sankey Diagram (by Packets, by Bytes, by Destination Port) - Microburst Dashboard (Bit timechart) - DNS / NFS / HTTP / Keep Alive Communication Dashboards - Hop Calculator between two IP's ROADMAP - Support for more protocols and more use cases - Dashboards will change to highlight the most important use cases for troubleshooting. FAQ http://devops-online.com/splunk-pcap-analyzer
I assume you constructed this add-on to make it easier to ingest .pcap files into Splunk. the issue i am having though is a compatibility issue. The newer versions of Splunk don't recognize the add-on without a serious amount of work. Is there a current work around for this issue?
New Version 5.0.0 is online on the splunkbase.
For troubleshooting there is also a new sourcetype defined sourcetype=pcap:analyzer:debug which can help you to understand where your problem is.
DanielSchwartz1
commented
8 months ago
I assume you constructed this add-on to make it easier to ingest .pcap files into Splunk. the issue i am having though is a compatibility issue. The newer versions of Splunk don't recognize the add-on without a serious amount of work. Is there a current work around for this issue?