Splunk Stream search syntax

The table summarizes Stream source and sourcetype search syntax.

Stream 6.1.0 or later Example
Syntax source=stream:<stream-id> sourcetype=stream:<protocol>
Search for a specific <stream-id> source=stream:<stream-id> source=stream:http, source=stream:tcp
Search for all <protocol> streams sourcetype=stream:<protocol> sourcetype=stream:http, sourcetype=stream:tcp

Note: The name that Stream assigns to an individual <stream-id> is the same as the underlying protocol.

How NetFlow timestamp data is processed

When any of the following fields are in a your NetFlow data, the Stream forwarder for the event sets the Splunk timestamp field to the value contained in the NetFlow flowStart* field and the Splunk endtime field value to be the value contained in the NetFlow flowEnd* field.

  • flowStartSeconds
  • flowEndSeconds
  • flowStartMilliseconds
  • flowEndMilliseconds
  • flowStartMicroseconds
  • flowEndMicroseconds
  • flowStartNanoseconds
  • flowEndNanoseconds

For NetFlow records that are not flow related, when observationTime* fields are available, Stream forwarder sets the Splunk timestamp and endtime fields to the NetFlow observationTime*.

If both flowStart* and observationTime* fields are in your NetFlow data, then Stream forwarder sets the Splunk Search timestamp to be the NetFlow flowStart* and the Splunk Search endtime field to contain the NetFlow observationTime* value.

If none of the above fields are present, and a NetFlow record has any of the following fields:

  • "first switch"(flowStartSysUpTime),
  • "last switch"(flowEndSysUpTime),
  • "system uptime"
  • "current device time in unix epoch"

then Stream forwarder calculates the Splunk Search timestamp and endtime as follows:

  • timestamp = ("device time in unix epoch" - "system uptime") + "first switched"(flowStartSysUpTime)
  • endtime = ("device time in unix epoch" - "system uptime") + "last switched"(flowEndSysUpTime)