[streamfwd]
* This is currently the only supported stanza for this spec file.
* All streamfwd.conf settings are incorporated under this single stanza.

clientIpSslHashBytes = <integer>
* Defines number of client IP octets to use for SSL processor thread hash algorithm. (min value = 0; max value = 4)
* Applies only if you have _disabled_ useGlobalSSLSessionKeyCache

duplicatePacketWindow = <integer>
* Defines number of packets cached in memory (using a rolling window) to detect duplicate packets.
* Set this to a value greater than zero to enable automatic deduplication of network packets.

hideCreditCardNumbers = <boolean>
* Masks credit card numbers. Set to false to show all credit card numbers.

mapSslServers = <boolean>
* Set to false to disable automatic caching of SSL server certificates to corresponding servers's IP addresses.

maxEventQueueSize = <integer>
* Defines maximum number of events queued for delivery to Splunk.

maxFieldSize = <bytes>
* Defines maximum size of content field.

maxPacketQueueSize = <integer>
* Defines maximum size for each processing thread's packet queue.

maxTcpReassemblyPacketCount = <integer>
* Defines maximum number of TCP packets in reassembly queue per processing thread.

maxTcpSessionCount = <integer>
* Defines maximum number of concurrent TCP/UDP flows per processing thread.

maxFlows = <integer>
* Defines maximum number of concurrent flows per prcessing thread.

pcapBufferSize = <bytes>
* Defines buffer size for each network device. Increase the number of bytes if you see dropped packets.

pingInterval = <seconds>
* Modifies the ping server interval.

processingThreads = <integer>
* Defines number of threads to use for processing network traffic.

sessionKeyTimeout = <seconds>
* Indicates idle time before SSL session keys expire.

tcpConnectionTimeout = <seconds>
* Indicates idle time before TCP/UDP flows expire.

tcpFlowTimeout = <seconds>
* Indicates idle time before TCP flows expire.

udpFlowTimeout = <seconds>
* Indicates idle time before UDP flows expire.

arpFlowTimeout = <seconds>
* Indicates idle time before ARP flows expire.

ipFlowTimeout = <seconds>
* Indicates idle time before IP flows expire.

useGlobalSSLSessionKeyCache = <boolean>
* Enables sharing of SSL cache across processing threads. Set to true to share.

usePacketMemoryPool = <boolean>
* When set to true, Stream forwarder uses a pool allocator to allot memory for storing network packets.
* Because the pool allocator does not release unused memory back to the operating system, setting this
parameter to true may result in high memory usage.
* Set to true only when Stream forwarder is running on a dedicated capture server that processes large
traffic volumes.

configTemplateName = <value>
* Indicates the product template to use. <value> is the valid name of an installed product template (e.g. es, itsi).

indexer.<N>.uri = <value>
* When running Stream forwarder in Independent agent mode, use this parameter to specify the location of 
Splunk indexers where you want to receive Stream forwarder generated events.
* <value> is a valid URI pointing to a Splunk indexer.

analyzeRawSSL = <value>

creditCardNumbersMask = <value>

creditCardNumbersRegex = <value>

httpEventCollectorToken = <value>

ipAddr = <value>

logConfig = <value>

maxEventAttributes = <value>

packetBatchSize = <value>

port = <value>

sslKey = <value>

fileServerMountPoint = <value>
* Mount point of a file server to save packets into PCAP files for targeted packet capture. This setting is also used for saving files that have been extracted while being transferred over the network.
* If this value is left blank, then the files will not be saved.

fileServerId = <value>
* File server id is used to uniquely identify the file server.
* This value needs to match the file server id set in the search head configuration. 
* If this value does not match with the value set in search head configuration, then the user will not be able to download the file using event flow action. 

maxFlowPacketsToCache = <integer>
* Maximum number of packets per flow to be cached and saved into PCAP files for targeted packet capture. 
* If the packet cache reaches this limit, then the earlier packets will be discarded to maintain this cache limit. This setting helps in managing the memory usage for targeted packet capture. 
* Higher value of this setting, will result in more memory usage.
* Default is 50.

packetSenderQueueSize = <integer>
* Defines number of files to be saved to the file server. If this queue gets full, then overflow of files will be discarded until there is space available to add a new file.
* Slow throughput to the file server could result in this queue getting full quickly.
* Default is 100000.