Step 1: create a flow record

flow record flows
match datalink mac source address input
match datalink mac destination address input
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
collect transport tcp flags
collect interface input
collect flow sampler
collect counter bytes long
collect counter packets long
collect timestamp sys-uptime first
collect timestamp sys-uptime last
!
!
!

Step 2: create a flow exporter

flow exporter export-to-inside
description flexible NF v9
destination 172.24.21.58
source Vlan98
transport udp 9996
template data timeout 60
!
!lets export some cool option templates
option interface-table
option exporter-stats
option sampler-table
!
!
!

Step 3: create a flow monitor

flow monitor nftest
record flows
exporter export-to-inside
cache timeout active 60
statistics packet protocol
!
!

Step 4 : Define a sampler :

sampler my-random-sampler
mode random 1 out-of 100
!
!

Step 5: Apply the flow monitor ‘nftest’ to each interface with the defined
sampler ‘my-random-sampler input” is for ingress

interface GigabitEthernet1/0/47
ip flow monitor nftest sampler my-random-sampler input
!
interface GigabitEthernet1/0/48
ip flow monitor nftest sampler my-random-sampler input
.
.

Diagnostics :

show flow exporter
show flow exporter export-to-inside statistics

Flow Exporter export-to-inside:
Packet send statistics (last cleared 00:13:03 ago):
Successfully sent: 0 (0 bytes)
Enqueued to process level: 18 (13924 bytes)

Client send statistics:
Client: Option options interface-table
Records added: 112
– sent: 112
Bytes added: 11200
– sent: 11200

Client: Option options exporter-statistics
Records added: 2
– sent: 2
Bytes added: 56
– sent: 56

Client: Option options sampler-table
Records added: 2
– sent: 2
Bytes added: 94
– sent: 94

Client: Flow Monitor nftest
Records added: 10
– sent: 10
Bytes added: 590
– sent: 590