topic Re: Issue getting data in in Security

Issue getting data in

ThomasLeroy — Mon, 12 Jan 2015 11:00:18 GMT

Hello,

I have an issue when i try to get data in Splunk 6.2.1
I created /opt/splunk/system/local/inputs.conf but i receive no data.

[udp://@ip:514]
connection_host = ip
index = firewall

whereas when iadd data from the webUI, there are no issue.
I put only udp://514, i know this is not a connectivity problem.
None of my modifications in the config file are apply when i restart Splunk

I really need help on this.

Thank you

Re: Issue getting data in

MuS — Mon, 12 Jan 2015 12:30:56 GMT

Hi ThomasLeroy,

adding an IP to this stanza, will not bind UDP input to this IP, but only accept traffic from this IP.
See the docs for more details on this http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/inputsconf

[udp://<remote server>:<port>]
* If <remote server> is specified, the specified port will only accept data from that server.
* If <remote server> is empty - [udp://<port>] - the port will accept data sent from any server.

cheers, MuS

Re: Issue getting data in

Patient — Mon, 28 Sep 2020 18:37:07 GMT

Hello,

To add an input by directly editing inputs.conf, add a stanza for the input. You can add the stanza to the inputs.conf file in $SPLUNK_HOME/etc/system/local/, or in your own custom application directory (in $SPLUNK_HOME/etc/apps//local). If you have not worked with Splunk's configuration files before, read "About configuration files" before you begin.

You configure the data input by adding attribute/value pairs to its stanza. You can set multiple attributes in an input stanza. If you do not specify a value for an attribute, Splunk Enterprise uses the default value that's preset in $SPLUNK_HOME/etc/system/default/inputs.conf.

Here's a simple example of adding a network input. This configuration directs Splunk Enterprise to listen on TCP port 9995 for raw data from any remote server. The host of the data is set as the DNS name of the remote server. All data will also be assigned the source type "log4j" and the source "tcp:9995".

[tcp://:9995]
connection_host = dns
sourcetype = log4j
source = tcp:9995

For more information, visit:
http://docs.splunk.com/Documentation/Splunk/6.1.5/Indexer/Aboutindexesandindexers