Subject: Urgent Support Needed – NetFlow v9 Template Not Being Sent to Splunk Stream

Dear Flowmon Support Team,

I hope this message finds you well.

I am currently experiencing an issue when sending NetFlow data from a Flowmon device to a Splunk instance using Splunk Stream. While the data appears to be received by Splunk, it cannot be properly decoded and shows up as encrypted or unreadable. The following warning message is appearing in the Splunk logs:

""2025-06-21 08:34:49 WARN [139703701448448] (NetflowManager/NetflowDecoder.cpp:1282) stream.NetflowReceiver - NetFlowDecoder::decodeFlow Unable to decode flow set data. No template with id 258 received for observation domain id 13000 from device 10.x.x.x. Dropping flow data set of size 328

""

Based on my understanding, this indicates that Splunk has not received the necessary NetFlow template required to decode the flow data. However, the Flowmon device is configured to resend templates every 4096 packets or every 600 seconds, as shown below:

Protocol used: NetFlow v9

Also tested with IPFIX for comparison)

Compatibility: Splunk Stream supports UDP and NetFlow v9

Template resend interval: Every 4096 packets or 600 seconds

Despite verifying the configuration, it appears that the template with ID 258 is not being sent, resulting in dropped flow records on the Splunk side.

I kindly request your assistance

Your prompt support would be greatly appreciated, as this data flow is critical to our operations.