πŸ“Œ Tool: Using Splunk to analyse MikroTik logs 4.0 (Graphing everything) πŸ’Ύ πŸ›  πŸ’» πŸ“Š

I think you can add multiple , like netflowReceiver.0.ip=X.X.X.X
netflowReceiver.1.ip=Y.Y.Y.Y

As each of these instances has fields for IP, port etc , I think its purpose it to be able to add multiple.
Never tried it :wink: I only have 1 Mikrotik

These sections on
netflowElement.1.id = 226
netflowElement.1.termid = netflow.postNATDestinationIPAddress
etc..

I think I added them while playing to get IPFIX working (IPFIX works with periodic templates of fields being transmitted).
I believe the default β€œdictionary” did not recognise certain Netflow field, hence the possibility to add new ones.
To be honest I don’t know anymore. They are not present in the β€œdefault” files so for sure some custom work.

Perhaps it something to do with this thread NetFlow. No longer showing NAT'd destination address - Something chnaged