topic Re: splunk add forward-server IP:PORT -auth user:pass - For UDP ??? in Getting Data In

splunk add forward-server IP:PORT -auth user:pass - For UDP ???

grillotron — Fri, 15 Mar 2013 09:19:27 GMT

Hi,

Please i need to use de UDP protocol to add Forwarders (Universal in my case) buy supoust its de same command working with another options of "forwarders"..

splunk add forward-server IP:PORT -auth user:pass

¿what is de sintaxis?

thanks

Re: splunk add forward-server IP:PORT -auth user:pass - For UDP ???

Ayn — Fri, 15 Mar 2013 09:57:38 GMT

No, forwarding from a Splunk instance to another cannot use UDP. Why would you need UDP?

If you really can't do this via TCP, you'll have to resort to sending syslog over UDP from the forwarder to the indexer.

Re: splunk add forward-server IP:PORT -auth user:pass - For UDP ???

kristian_kolb — Fri, 15 Mar 2013 10:07:34 GMT

and that would not be a good idea, since you'd then be limited to standard syslog limits (<1k message size, single line). Try to fit a stacktrace, or eventlog message into that... 🙂

Re: splunk add forward-server IP:PORT -auth user:pass - For UDP ???

grillotron — Thu, 21 Mar 2013 07:53:32 GMT

Hi,

I don't need to use UDP ... it's only to keep the same way UDP/514. But really... i don't need it - i will create a recibe data port tcp/514.

thanks

Re: splunk add forward-server IP:PORT -auth user:pass - For UDP ???

grillotron — Thu, 21 Mar 2013 07:53:40 GMT

Hi,

I don't need to use UDP ... it's only to keep the same way UDP/514. But really... i don't need it - i will create a recibe data port tcp/514.

thanks

Re: splunk add forward-server IP:PORT -auth user:pass - For UDP ???

Ayn — Thu, 21 Mar 2013 07:56:42 GMT

Righty. By the way, the best thing would be to use Splunk's own protocol for forwarding events from one Splunk instance to another (splunktcp) rather than just sending the raw data (tcp).