topic Re: How to configure a forwarder to listen on tcp/udp for syslog for Splunk Light cloud service? in Getting Data In

How to configure a forwarder to listen on tcp/udp for syslog for Splunk Light cloud service?

sperschall — Wed, 13 Apr 2016 20:48:05 GMT

Hey,

I'm new to Splunk, so I may be missing something... However, I can't seem to configure a forwarder to listen on a network port (tcp/udp for syslog).

So far I have:
- Installed the forwarder which shows up in the Splunk Light dloud portal
- I have set the forwarder to monitor local event logs and the data is flowing into Splunk ok
- When I go to Add data, select the forwarder, select the server class, I can't click on the option for "Configure Splunk to listen on a network port." It also seems to be missing it's blue heading in that box. I can click on the other four options, but not that one.

Any ideas? Am I missing something?

Thanks...Scott

Re: How to configure a forwarder to listen on tcp/udp for syslog for Splunk Light cloud service?

jterry — Wed, 13 Apr 2016 21:07:30 GMT

could you post a screen-shot?
if you have a server class defined that contains the forwarder(s) you're trying to enable the tcp/udp input on then there shouldn't be a problem.
thnx

Re: How to configure a forwarder to listen on tcp/udp for syslog for Splunk Light cloud service?

sperschall — Wed, 13 Apr 2016 21:12:14 GMT

Sure...here you go.

Re: How to configure a forwarder to listen on tcp/udp for syslog for Splunk Light cloud service?

jterry — Wed, 13 Apr 2016 21:27:21 GMT

ok, thnx. i'm looking into it/trying to re-produce the issue.

Re: How to configure a forwarder to listen on tcp/udp for syslog for Splunk Light cloud service?

jterry — Wed, 13 Apr 2016 22:15:37 GMT

for now, the "Use the CLI" section of this doc may help: http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/Configureyourinputs#Use_the_CLI

Re: How to configure a forwarder to listen on tcp/udp for syslog for Splunk Light cloud service?

dkoshe_splunk — Wed, 13 Apr 2016 22:22:50 GMT

Looks like there is a bug introduced in the recent version that is preventing UI from working.
As a work around you can go to the machine where forwarder is running, and manually create (if none exists) inputs.conf file in /etc/system/local folder and update/add TCP input there and restart the forwarder (/bin/splunk restart).

Example stanza for receiving syslog via TCP input (update for your port and source type as appropriate):

[tcp://33333]
sourcetype=syslog
disabled=false