topic Re: Setting up Splunk receiver through TCP/IP in Getting Data In

Setting up Splunk receiver through TCP/IP

Caio_Santos — Tue, 14 Sep 2010 03:42:27 GMT

Hey everybody,

I'm going through some problems trying to set my receiver splunk instance. I performed exactely the ways which is described on the documantation, although Im still getting one error when I attempt to save my new date TCP input.

That's the error:

Encountered the following error while trying to save: In handler 'raw': TCP port 333 is not available.

As I said before, I followed each step on the docs, but for sure I'm missing something. I am sorry if I am being an ignorant, but I'm just starting with splunk.

Thank you in advance.

Re: Setting up Splunk receiver through TCP/IP

southeringtonp — Tue, 14 Sep 2010 03:51:34 GMT

Is something else running on port 333 already? At the command line, try running netstat -an to check.

Also, if you are running Splunk as a non-root user, Splunk will not be able to bind to ports below 1024, as those ports are considered privileged.

Do you have the same problem with other port numbers, especially with port numbers above 1024?

Re: Setting up Splunk receiver through TCP/IP

Genti — Tue, 14 Sep 2010 04:09:25 GMT

Caio, is this on a unix box?
If so, there might be a permission issue as only root can open ports under 1024.
You can try listening to tcp on a higher port, say 9001. Let us know if you get similar errors then.
Cheers,
.gz