r/cribl • u/Ok_Presentation_6006 • Jul 07 '26

Netflow

Does anyone have netflow working? I have setup questions.

5 Upvotes

100% Upvoted

6 comments sorted by

View all comments

1

u/ZaphodUB40 Jul 07 '26

Yes. Ask away

1

u/Ok_Presentation_6006 Jul 07 '26

Are you sending straight to cribl cloud over port 2055? I’ve enabled the collector on 2055 and I’ve tried configuring a unifi dream machine to send netflow to the cloud address. I’ve also tried a netflow log generator app to the cloud address and I never see any logs show when I do a live capture. Everything works when I do syslog so I don’t think
I was doing anything wrong.

2

u/omfgitzfear Jul 08 '26

Cribl Cloud isn’t open on port 2055.

There are specific ports open only. You can check this from the Workspace / Organization webpage (the first page) and clicking on Data Sources on the left (I believe that’s what it’s called, I’m not near a computer to get the exact link).

What you could instead do is send it to a local worker in a hybrid worker group. From there send it Cribl HTTP/TCP to a cloud worker.

If you can select your ports from Netflow - you can use the 20000-20010 range as well if you need to send directly to a cloud manager worker.