topic Re: SplunkUniversalForwarder & UDP transfer in Getting Data In

SplunkUniversalForwarder & UDP transfer

Vladimir — Thu, 21 Jul 2011 12:29:54 GMT

Hey!

Is it possible to configure SplunkUniversalForwarder to receive data by udp and send this data to indexer? How?

In my forwarder's inputs.conf

[udp://:9999] index = myindex source = mysource sourcetype = mysource

Output is also configured, i'm pulling wmi data within it. But when I'm sending data to forwarder's udp port I cannot see it in indexer. What am I doing wrong?

Thanks

Re: SplunkUniversalForwarder & UDP transfer

jbsplunk — Thu, 21 Jul 2011 18:40:31 GMT

You should be able to collect udp data from the forwarder and send it to the indexer. There aren't any constraints on types of data that can be forwarded. I would check splunkd.log to look for connection information from the forwarder to the indexer, and also check splunkd.log on the indexer to ensure you are getting a connection. If a failure is occurring, you should be able to determine why by looking at the log. Have you checked metrics.log via the indexers search? Something like this might be helpful:

index=_internal group="per_source_thruput" NOT series="*splunk/var/log*" | eval mb=kb/1024| timechart span=1d sum(mb) by series

index=_internal group="per_sourcetype_thruput" NOT series="splunk*" | eval mb=kb/1024| timechart span=1d sum(mb) by series

Re: SplunkUniversalForwarder & UDP transfer

Vladimir — Fri, 22 Jul 2011 07:26:51 GMT

Thanks. I've checked it, there wasn't any failures in log so it wasn't a splunk problem. The problem was in firewall rules.