topic Re: How to configure different sourcetypes for udp port 514 ? in Getting Data In

How to configure different sourcetypes for udp port 514 ?

aeshan — Mon, 29 Dec 2014 10:52:45 GMT

Hello,

I have configured two network devices (cisco router and fortigate firewall) to send logs to Splunk server via udp port 514 .I can successfully see all the raw logs but particular apps wont show any data because the sourcetype doesnt match.I cant define different sourcetypes to same udp port in "data inputs".How can I overcome this issue ?

Re: How to configure different sourcetypes for udp port 514 ?

treinke — Mon, 29 Dec 2014 14:56:32 GMT

You can use the following in your inputs.conf

[udp://123.456.789:514]
index = networking
sourcetype = cisco

[udp://123.456.890:514]
index = networking
sourcetype = fortinet

Re: How to configure different sourcetypes for udp port 514 ?

aeshan — Wed, 31 Dec 2014 04:36:18 GMT

Thank you very much for the solution.Can you please specify which inputs.conf file I should edited.I saw there several inputs.conf files in several folders.

Re: How to configure different sourcetypes for udp port 514 ?

jayannah — Wed, 31 Dec 2014 04:49:14 GMT

whats your splunk topology and source paths?

Re: How to configure different sourcetypes for udp port 514 ?

kml_uvce — Wed, 31 Dec 2014 04:53:06 GMT

you can edit in local directory of app name folder
$SPLUNK_HOME/etc/apps/app-name/local/inputs.conf
or you can directly modify from splunk web
http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver

Re: How to configure different sourcetypes for udp port 514 ?

treinke — Wed, 31 Dec 2014 05:24:02 GMT

When you configure the inputs from the website, the inputs.conf file will be in the app folder that you were in before you when in to the inputs section. For example if you were in the Search & Reporting app, current location for your inputs.conf would be in

$SPLUNK_HOME/etc/apps/search/local/inputs.conf

If you are not sure where to store your file with these stanzas, you can use

$SPLUNK_HOME/etc/system/local/inputs.conf

Re: How to configure different sourcetypes for udp port 514 ?

ppablo — Wed, 07 Jan 2015 02:45:34 GMT

Hi @aeshan

Did Anthony Reinke's or @kml_uvce's answers below solve your question? If yes, please accept the one that did to resolve this post by clicking "Accept" right below the appropriate answer. Thanks!

Patrick

Re: How to configure different sourcetypes for udp port 514 ?

82padarthi — Mon, 28 Sep 2020 18:34:58 GMT

Hi..

Edit the inputs.conf file in $SPLUNK_HOME/etc/apps/app-name/local/inputs.conf or $SPLUNK_HOME/etc/system/local/inputs.conf or $SPLUNK_HOME/etc/apps/search/local/inputs.conf
Note : no need to edit and enter the below configuration in all the input file. any one of the file is fine

[udp://ipaddressofthedevice:514]
index = linux
sourcetype = linuxevents

[udp://ipaddressofthdevice:514]
index = linux
sourcetype = syslog

Ex :
[udp://10.1.1.10:514]
index = linux
sourcetype = linuxevents

[udp://192.168.1.9:514]
index = linux
sourcetype = syslog

Re: How to configure different sourcetypes for udp port 514 ?

jdanij — Mon, 19 Oct 2015 23:05:40 GMT

Up to the config, you cannot define more than one input for the same port:
[udp://:]
* Similar to TCP, except that it listens on a UDP port.
* Only one stanza per port number is currently supported.

However, did it work for any of you??

Re: How to configure different sourcetypes for udp port 514 ?

treinke — Wed, 21 Oct 2015 20:23:13 GMT

you are adding an ip address to limit the input selection. if you added [udp://514] to the inputs.conf file, you are saying any ip address on UDP port 514. This is really more like [udp://*:514] . When you add the ip address in to the stanza, you are narrowing down the parameters. So [udp://123.456.789:514] is saying from this ip on this port, do the following the in the stanza.

Re: How to configure different sourcetypes for udp port 514 ?

tiagomiranda — Mon, 01 Feb 2016 18:43:53 GMT

Why when I restrict host I don't receive anything?There is some specific configuration?
My firewall and my switch are allow to send logs.

Re: How to configure different sourcetypes for udp port 514 ?

treinke — Mon, 01 Feb 2016 18:51:33 GMT

are you seeing the packets with tcpdump/wireshark on the Splunk server?

Re: How to configure different sourcetypes for udp port 514 ?

amnonh — Tue, 04 Apr 2023 11:14:02 GMT

This exactly as stated here, totally worked for us (Splunk 9)
Create the inputs.con file, add stanza as indicated here, no more no less and save the file. In Config Explorer do a debug/refresh and you will see these special inputs appear in the GUI as "[IP]:[PORT]" and data will trickle in to the specified index(es) using the specified sourcetype.