https://community.splunk.com/t5/Security/Syslogs-are-not-shown/m-p/67517#M2220 <P>What do you mean when you say you have checked with a port analyzer?<BR /> Some things I would check;</P> <UL> <LI>That there is an exception on the machine for UDP port 514 for any firewall software that may be running</LI> <LI>The syslog server is correctly configured and isn't perhaps forwarding from any other port. By default it should be 514 on most standard syslog servers and will work with a line like...</LI> </UL> <BLOCKQUOTE> <PRE><CODE>*.* @SPLUNKIP </CODE></PRE> </BLOCKQUOTE> <UL> <LI>Have you tried a search for the host ip on the splunk server? Just incase it's not indexing them where you think it may be putting them</LI> </UL> Fri, 02 Sep 2011 14:06:22 GMT Drainy 2011-09-02T14:06:22Z https://community.splunk.com/t5/Security/Syslogs-are-not-shown/m-p/67516#M2219 <P>Hello, I am testing Splunk, I have created a Data Input for UDP port 514, but there are no entries in the index. I have checked with a port analyzer and Syslogs from network hosts are being received. Do you have any idea about what could be the problem?</P> <P>Regards</P> Tue, 30 Aug 2011 23:45:21 GMT https://community.splunk.com/t5/Security/Syslogs-are-not-shown/m-p/67516#M2219 gnazer 2011-08-30T23:45:21Z https://community.splunk.com/t5/Security/Syslogs-are-not-shown/m-p/67517#M2220 <P>What do you mean when you say you have checked with a port analyzer?<BR /> Some things I would check;</P> <UL> <LI>That there is an exception on the machine for UDP port 514 for any firewall software that may be running</LI> <LI>The syslog server is correctly configured and isn't perhaps forwarding from any other port. By default it should be 514 on most standard syslog servers and will work with a line like...</LI> </UL> <BLOCKQUOTE> <PRE><CODE>*.* @SPLUNKIP </CODE></PRE> </BLOCKQUOTE> <UL> <LI>Have you tried a search for the host ip on the splunk server? Just incase it's not indexing them where you think it may be putting them</LI> </UL> Fri, 02 Sep 2011 14:06:22 GMT https://community.splunk.com/t5/Security/Syslogs-are-not-shown/m-p/67517#M2220 Drainy 2011-09-02T14:06:22Z