topic Setting up syslog on a wireless router in Getting Data In

Setting up syslog on a wireless router

John_neville — Wed, 17 Nov 2010 23:41:55 GMT

I have configured Splunk to capture syslog data on UDP:514 of my router but do not see any log data being captured, nor do I see it as a "Source" of data captured in in the "All Indexed data" of the Manager summary screen. I do see the local sources displayed here, but not the network port 514.

When I enter the command "splunk list udp" it comes back saying it is listening on port 514

Any suggestions would be appreciated - Thanks - John

Re: Setting up syslog on a wireless router

ziegfried — Wed, 17 Nov 2010 23:56:25 GMT

Have you configured the router to send the data over to Splunk? Can you validate that data is arriving using something like Wireshark? Maybe the router is sending data over TCP?

Re: Setting up syslog on a wireless router

kjpearsall — Thu, 06 Jun 2013 15:29:23 GMT

Is udp port 514 open on the firewall of the machine that Splunk is listening on?