topic Getting error when entering port number for a receiver in new installation in Getting Data In

Getting error when entering port number for a receiver in new installation

pexelva — Mon, 20 Nov 2023 18:14:38 GMT

I get the following error when I try to add a receiver with port 9997 or 514.

The following error was reported: SyntaxError: Unexpected token '<', " <p class=""... is not valid JSON.

I get the same error no matter what port I try to enter. This is a new installation and this is the first thing I tried to do. I am somewhat of a novice with splunk.

Re: Getting error when entering port number for a receiver in new installation

richgalloway — Mon, 20 Nov 2023 18:57:50 GMT

We need more information. How exactly are you trying to add a receiver port? What command are you issuing and where are you entering it?

Re: Getting error when entering port number for a receiver in new installation

pexelva — Mon, 20 Nov 2023 19:12:46 GMT

I have an Enterprise free trial system that I installed on an Ubuntu Server. In the gui I went to the settings>forwarding and receiving>receiving>add new because I am going to try and set up a forwarder. On the Add New page I entered 514 in the Listen on this port field. I get the rror after I click save.

I want to use this for gathering syslog data from my OPNsense router and then build a dashboard for it.

I also keep getting this message when trying change settings CSRF validation failed

Re: Getting error when entering port number for a receiver in new installation

richgalloway — Mon, 20 Nov 2023 21:45:49 GMT

Splunk has "free" licenses and "trial" licenses (also free) with different capabilities. Which do you have?

Splunk forwarders typically send data to Splunk indexers on port 9997.

Splunk can receive syslog data on port 514, but it's not recommended. To set that up, go to Settings->Data inputs->TCP (or UDP, if you prefer) and click the green button. Then fill in the form and click Save.