Aggregate NTA data to Splunk

Question

Perhaps I've overlooked in my searching but haven't come up with a solution yet. I'm not a Splunk admin, more on the Solarwinds side but another team who manages Splunk would like to see what aggregate data we can pull from Solarwinds Netflow, and ingest it into Splunk?

Any ideas? Any help/direction is appreciated.

mesverrum · Answer

Curious what they are intending to collect. Splunk itself can process raw flow data the same at NTA does but maybe they are trying to have Orion do the bulk ingestion and then only push some specific event data to Splunk to save on costs?

bobmarley · Answer

Yep it is possible. There is a SolarWinds App for Splunk, we use it to pull in events. It doesn't pull in Netflow data that is aggregated though. You can have Splunk attach to the Orion database and perform SQL queries however. Google 'performing a SQL query from Splunk' and you can find out the details.