topic Re: Not getting any data in All Apps and Add-ons

Not getting any data

pollo123 — Mon, 30 Jul 2012 19:11:43 GMT

I'm trying to configure UDP Data input, can't configure port 514 and I am not getting any data, can someone help please? I read the README, but still not getting anything. Thanks.

Re: Not getting any data

jbsplunk — Mon, 30 Jul 2012 19:44:18 GMT

Can you elaborate on what the exact steps you took were, and the nature of the failure you encountered? It would be helpful if we could understand the specifics of the problem.

Re: Not getting any data

Takajian — Tue, 31 Jul 2012 06:11:34 GMT

Can you confirm if firewall of your platform is disabled and splunk is listening with udp:514?

Re: Not getting any data

pollo123 — Tue, 31 Jul 2012 14:06:57 GMT

I am getting an error message: port 514 is unavailable. What does this mean? I'm using a trial version. Am I missing a license or permissions?

Re: Not getting any data

DTERM — Tue, 31 Jul 2012 14:39:01 GMT

Here are a few hints, I hope they are helpful.

On your splunk host, ensure that IPTables is not turned on.
From the splunk client, try a UDP nmap command to the host, here is an example nmap -sU -p 9997 -P0 myhost.mydomain.com
On the splunk client run TCPDump to ensure you are seeing the data arrive.

If none of those work, you may want to look at your configuration. Hope that helps.

Re: Not getting any data

pollo123 — Tue, 31 Jul 2012 19:12:16 GMT

I can get data now with sourcetype syslog in the regular Splunk search using UDP (Port 514)but not in the Juniper SRX dashboard. I read from an answer to another question I should change the sourcetype to srx_log, I changed that under data input but still did not get any traffic.

Re: Not getting any data

pollo123 — Tue, 31 Jul 2012 19:12:37 GMT

Re: Not getting any data

pollo123 — Tue, 31 Jul 2012 19:12:48 GMT