Two types of data over the same port?

paulgo — Mon, 10 Oct 2022 16:39:32 GMT

I'm trying to get both JSON and syslog information from our firewall into Splunk Cloud using universal forwarder.

So far I've gotten the JSON in by getting splunk to listen to port 514, forward that to the index, and then adding it using

splunk add udp 514 -sourcetype JSON

However, now I want to add the syslog information as well, which comes over the same port. When I attempt to add that I get an error:

splunk add udp 514 -sourcetype syslog
Parameter name: UDP port 514 is not available.

How do I get the splunk index to read both from the same port?

Re: Two types of data over the same port?

richgalloway — Mon, 10 Oct 2022 16:50:52 GMT

In short, you can't. You've already "used up" port 514 with JSON data so you can't also use it for syslog.

Splunk recommends against ingesting TCP or UDP data directly as data will be lost whenever Splunk restarts.

The preferred way to ingest syslog data is to stand up a dedicated syslog server (syslog-ng or rsyslog) and have that server forward (using a UF) to Splunk. Alternatively, you can use the Splunk Connect for Syslog (SC4S) app to do both.

topic Re: Two types of data over the same port? in Getting Data In

Two types of data over the same port?

Re: Two types of data over the same port?