topic Re: Splunk web app not receiving message from client in Getting Data In

Splunk web app not receiving message from client

fortinet1 — Mon, 14 Jul 2014 16:20:27 GMT

Hi All,

I am new to this splunk community and as such usage of splunk in general. I have a unit which is configured to send syslog to any server. For this purpose I have splunk web app running on a system (Windows 7). The netstat -b -a command shows splunkd and splunkweb running ( LISTENING):

TCP   0.0.0.0:514         abc-PC:0            LISTENING
[splunkd.exe]
TCP   0.0.0.0:8000         abc-PC:0            LISTENING
[splunkweb.exe]
TCP    0.0.0.0:8089         abc-PC:0            LISTENING
[splunkd.exe]
TCP     0.0.0.0:9997        abc-PC:0            LISTENING
[splunkd.exe]
....
...
UDP   0.0.0.0:515            *:*
[splunkd.exe]

The client which is sending the syslog server has IP: 192.168.1.99
The system where my splunk web app (abc-PC) is running has IP: 192.168.0.99 ( both can ping each other)

The client is configured to sent the syslog on port 514. But as you can see from the netstat output, splunk seems to be listening on 514 but log is empty. How to resolve or suggest some ways to proceed in debugging. Also why do I see multiple splunkd.exe running. Is it normal?

Hope to get some suggestions/feedback soon.

THanks

Re: Splunk web app not receiving message from client

martin_mueller — Mon, 14 Jul 2014 22:03:32 GMT

Your netstat suggests that Splunk is listening on UDP port 515 instead of 514. Make sure your syslog sender and Splunk agree on the port number 🙂
Open your Splunk web interface, go to Settings -> Data Inputs -> UDP and tell us what you see.

Re: Splunk web app not receiving message from client

fortinet1 — Tue, 15 Jul 2014 21:21:27 GMT

Yes, its been set, Where do I exactly check the logs sent by my syslog sender.

Re: Splunk web app not receiving message from client

martin_mueller — Tue, 15 Jul 2014 21:59:17 GMT

That depends on what you've set in the corresponding inputs.conf entry.

Re: Splunk web app not receiving message from client

fortinet1 — Mon, 28 Sep 2020 17:05:50 GMT

There are multiple inputs.conf file under
C:/\Program Files/\Splunk/\etc/\apps/\search/\local/\
C:/\Program Files/\Splunk/\etc/\system/\local
C:/\Program Files/\Splunk/\etc/\system/\default
C:/\Program Files/\Splunk/\etc/\apps/\splunk_app_window and so on.

Is there a guide which tells me which input.conf file needs to be changed ?

Re: Splunk web app not receiving message from client

martin_mueller — Wed, 16 Jul 2014 17:03:52 GMT

First you should read and understand this: http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Configurationfiledirectories - the surrounding pages don't hurt either.

Where that UDP input is depends on where you've configured it to be. It'll certainly be in some local directory, because default isn't meant to be changed by the end user.
You could check through all of them, or run this:

$SPLUNK_HOME/bin/splunk cmd btool --debug inputs list udp