search

DanielSchwartz1 / SplunkForPCAP

The PCAP Analyzer for Splunk includes useful Dashboards to analyze network packet capture files from Wireshark or Network Monitor (.pcap) and network streaming data (Splunk App for Stream). The App includes Dashboards which will show you: - The Top Talker IP's, Protocols, VLANs, Conversations - Detailed overview about IP Conversations, Packet Loss, TCP Error's, Round Trip Time - Conversation Sankey Diagram (by Packets, by Bytes, by Destination Port) - Microburst Dashboard (Bit timechart) - DNS / NFS / HTTP / Keep Alive Communication Dashboards - Hop Calculator between two IP's ROADMAP - Support for more protocols and more use cases - Dashboards will change to highlight the most important use cases for troubleshooting. FAQ http://devops-online.com/splunk-pcap-analyzer
MIT License
42 stars 7 forks source link

PCAP Conversion not working #8

Open mohdahsank001 opened 3 years ago

mohdahsank001 commented 3 years ago

Hi,

I have set the PCAP Analyzer in my Splunk enterprise software. After setting up PCAP file location, I could see that the CONF file inputs.conf has been created. However, PCAP conversion is not working and there are no new files created inside PCAPConverted and PCAPcsv folder. Any idea why this might be happening ?

With thanks ,

Mo

cyberdaddy93 commented 1 year ago

any updates on this issue?

DanielSchwartz1 commented 10 months ago

New Version 5.0.0 is online on the splunkbase. For troubleshooting there is also a new sourcetype defined sourcetype=pcap:analyzer:debug which can help you to understand where your problem is.