topic Re: Correct format for specifying network inputs in Getting Data In

Correct format for specifying network inputs

termcap — Fri, 11 Jun 2021 04:45:17 GMT

Hi,

The Splunk documentation for inputs.conf presents the format to add a network input as follows [Notice the ":" before the port number]

[tcp://:9995] connection_host = dns sourcetype = log4j source = tcp:9995

I went ahead and added a network input from Splunk Web and checked the inputs.conf file and found a different format as shown below. [Notice the lack of ":" before 1333]

[tcp://1333] connection_host = dns host = splunk-indx1 sourcetype = log4php

So what is the appropriate format ?

Thanks,

Termcap

Re: Correct format for specifying network inputs

venkatasri — Fri, 11 Jun 2021 05:07:21 GMT

Hi @termcap

An example from inputs.conf spec below, however i find your both settings should work fine.

# The following configuration listens on TCP port 9995 for raw # data from ANY remote server. The host of the data is set as the host name of # the remote server. All data will also be assigned the sourcetype "log4j" and # the source "tcp:9995". [tcp://:9995] connection_host = dns sourcetype = log4j source = tcp:9995

-----

An upvote would be appreciated if it helps!

Re: Correct format for specifying network inputs

termcap — Fri, 11 Jun 2021 05:10:33 GMT

Hi @venkatasri, I think both are indeed working fine, but I'm just wondering what is the reason for the difference in the documentation and the way Splunk web writes the configuration file when a network input is added.

Re: Correct format for specifying network inputs

venkatasri — Fri, 11 Jun 2021 05:16:49 GMT

Could be a backward compatibility they both are same without remote_server port just listens on every host available that's the purpose.