Netflow Activity dashboard showing MB’s in to dest_ip

Description:

Dashboard that helps me understand activity in my home lab looking at netflow data from my OPNsense firewall.  This dashboard starts with a simple timechart that gives me a trend of average mb_in across all of my devices. I have OPNsense configured to send netflow data v9 to a Splunk independent stream forward which then sends to my Splunk indexer.  

This dashboard utilizes the Network Topology – Custom Visualization and the Network Toolkit to be more interactive and perform WHOIS actions on source IP addresses.  You will need to have both of those apps installed for the dashboard to work as intended.  

You will also need to adjust the base search of this dashboard to match the index where the netflow data lives.  This dashboard uses post processing and you will need to edit the source XML provided. 

Here is a video that provides an overview of the dashboard and how to adjust the source XML:

Add-on’s required:

Network Topology – Custom Visualization: https://splunkbase.splunk.com/app/3762/

Network Toolkit: https://splunkbase.splunk.com/app/3491/

Dashboard:

Share This:

Leave A Comment?