topic Re: Unable to add TCP Data Inputs in Splunk Cloud in Getting Data In

Unable to add TCP Data Inputs in Splunk Cloud

bobbyavn — Sat, 31 Jan 2015 06:15:41 GMT

Hi,
I'm using Splunk Cloud and I'm unable to add a new Data Input. I'm entering all the required fields but when I click on Save the UI shows an error "Please enter all required fields". The UI does not indicate which field I'm missing.
Steps to reproduce,
Go to Settings->Data inputs->(under Forwarded Inputs)TCP->New and then under Source enter a TCP Port: 9800
Accept Connections from all hosts?
Yes
Source name override (Left it empty). It does not say it is mandatory.
Source Type
Set Source Type -> From List
Select Source Type from List -> syslog

Under More Settings
Host->Set Host -> IP
Index->default.

with the above specified inputs when i click "save" it throws an error to fill in required fields. Not sure what I missed.
Please help.
thanks
MV

Re: Unable to add TCP Data Inputs in Splunk Cloud

esix_splunk — Wed, 29 Apr 2015 08:33:22 GMT

You wont be able to create new TCP inputs into Splunk Cloud. Inbound ports are blocked, you will need to submit a ticket to have this created and enabled.

Re: Unable to add TCP Data Inputs in Splunk Cloud

yannK — Fri, 11 Sep 2015 15:27:14 GMT

Splunkcloud only accepts secure connections from forwarders with the correct SLL certificates.
The solution is to use a forwarder on your side to listen to syslog (tcp or udp), and configure the forwarder to to splunkcloud.