Repository navigation
Getting Started ‐ first configuration
“PCAP Analyzer for Splunk” requires a full splunk instance running on *nix / Windows systems and Wireshark needs to be installed.
In summary the most important requirements are the following:
- Splunk instance with SPLUNK_HOME variable defined.
- Wireshark installed (on Windows: Wireshark needs to be located at %programfiles%)
- Confirm that your user has all administrative privileges for the folders “$SPLUNK_HOME/etc/apps/SplunkForPCAP/bin/” and for your Wireshark folder.
As soon as you have installed the “PCAP Analyzer for Splunk” on your Splunk instance the next step is to define a folder on your system which should be monitored for “*.pcap” files. You can define this folder in the WebUI via Settings –> Data Inputs –> PCAP File Location.
In this configuration panel you have to define a name and a path. Lets make an example and use as name “myfolder” and as path “/var/tmp/”.
With this configuration a new folder will be created automatically at “$SPLUNK_HOME/etc/apps/SplunkForPCAP/”. It is the “local” folder which includes an “inputs.conf” file.
If you can confirm that the above steps has been done successful, the next step is to put a “*.pcap” or “.pcapng” file in your folder you have defined (e.g. /var/tmp/). Now the rest is done by the app.
“PCAP Analyzer for Splunk” checks every 5 minutes if a new pcap file has been added to your folder. If it finds a new pcap file it will be converted and indexed automatically into Splunk.
You can open a dashboard in the application and you should find your pcap file in the dropdown menu.
As soon as your “*.pcap” file is processed, it will be moved to the “converted” folder within your defined location. No need to worry 🙂 Your files will be converted to an output file which are created in the folder “$SPLUNK_HOME/etc/apps/SplunkForPCAP/PCAP_Output”. You can delete those file after the indexing is done.