topic Why am I getting "ERROR TcpInputProc - Received unexpected 1380997408 byte message" forwarding my fortigate logs to Splunk? in Getting Data In

Why am I getting "ERROR TcpInputProc - Received unexpected 1380997408 byte message" forwarding my fortigate logs to Splunk?

sympatiko — Wed, 19 Nov 2014 04:58:50 GMT

Hi,

I'm just new with splunk. I'm getting this error upon forwarding my fortigate logs to splunk. How can I set splunk to listen on UDP logs?

Thanks

Re: Why am I getting "ERROR TcpInputProc - Received unexpected 1380997408 byte message" forwarding my fortigate logs to Splunk?

MuS — Wed, 19 Nov 2014 09:03:43 GMT

Hi sympatiko,

take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/SyslogTCP

cheers, MuS

Re: Why am I getting "ERROR TcpInputProc - Received unexpected 1380997408 byte message" forwarding my fortigate logs to Splunk?

sympatiko — Wed, 19 Nov 2014 09:32:29 GMT

Hi MuS,

Thanks for your help. Are you familiar with this error "Received unexpected 1380997408 byte message (Invalid payload_size=1380997408 received while in parseState=1)!" . As I've understand it pertains to the size being forward by my fortigate firewall,is it? Correct me if I'm wrong.

Thanks for your help!

Re: Why am I getting "ERROR TcpInputProc - Received unexpected 1380997408 byte message" forwarding my fortigate logs to Splunk?

MuS — Wed, 19 Nov 2014 09:42:21 GMT

which port are you sending the fortigate stream?

Re: Why am I getting "ERROR TcpInputProc - Received unexpected 1380997408 byte message" forwarding my fortigate logs to Splunk?

sympatiko — Mon, 28 Sep 2020 18:12:04 GMT

I already fixed the issue by adding an UDP data input config. Now I'm getting this error in the splunkd.logs

ERROR SearchParser - Could not find macro 'fortigate_webfilter' that takes 0 arguments. Expecting stanza name 'fortigate_webfilter'

Any idea?

Thanks,
Eddel