Devices that export sFlow should send their sFlow data over UDP to port 6343 of the Logsign Unified SecOps Platform IP address. Logsign listens for sFlow on this port by default, so no extra configuration is needed on the Logsign server.
Note that: Sflow configuration varies according to different vendors.
1- Make sure that the data reaches port 6343 with the following command.
2- Go to Settings > Integrations > Data Collection and click the “+ Device” button.
3- In the Devices field, select NETFLOW. In the Flow Type field, select SFlow. The Port field is filled in automatically as 6343 and cannot be edited. In the Host field, enter the IPv4 address of the device that sends the sFlow data. Enter a Device Name, fill in the other fields as needed, and then click the Save button.
Logsign matches incoming sFlow records to this source by the sampler (agent) address in the sFlow data and port 6343. If the Host value does not match that address, the records are not shown under the source.