Configure a Device or Host for NetFlow, IPFIX, or J-Flow Collection

On the main toolbar, click Deployment Manager.
Click the System Monitors tab.
If needed, add Host Records for the NetFlow/IPFIX/J-Flow receiving system and the NetFlow/IPFIX/J-Flow sending system. These may be the same device.

You can select an Origin or Impacted Host as the Known Host from a log returned in search results. For more information see Monitor, Search, and Analysis.
Install and configure a System Monitor Agent Pro on the NetFlow/IPFIX/J-Flow receiving server. For more details, see System Monitor.
Direct the NetFlow/IPFIX/J-Flow generating device to send its NetFlow/IPFIX/J-Flow information to the NetFlow/IPFIX/J-Flow receiving System Monitor Agent.

See the device's documentation.
Accept the new Agent in the System Monitors tab. For more information, see Agent Identification and Acceptance.
From the System Monitors tab, the agent can be viewed in the upper grid.
1. Right-click the selection, click Actions, and then click Accept.
2. Click OK.
Enable the NetFlow/IPFIX/J-Flow Server on the System Monitor Agent.
1. From the System Monitors tab, double-click the agent.
2. Click the Syslog and Flow Settings tab.
3. Select the Enable Syslog Server check box.
4. Select the Enable NetFlow/IPFIX/J-Flow Server check box.
5. (Optional) Click Advanced and edit the NetFlow/IPFIX/J-Flow Server Advanced Agent Properties.
6. Click OK.
The Log appears in the Log Sources tab in the New Log Sources grid with a status of Pending.
Configure the Log Source with the appropriate Log Source Type and Log Processing Policy. Then, accept the new Syslog Log Source. For more information, see Log Sources.
Verify that the NetFlow/IPFIX/J-Flow traffic is being received using Investigator or Tail.

This process only allows you to collect IPFIX default fields. To collect vendor specific fields, see Customize IPFIX Logs.