Manually created inputs.conf and still no data

kluey — Wed, 13 Nov 2013 22:43:55 GMT

I installed the add-on and tried to follow the directions. After installing, there was no 'Set up' as stated in the readme file, so I manually created the inputs.conf and added lines below (Note: These are the only lines in the inputs.conf file):

\Splunk\etc\apps\Splunk_Ciscofirewalls\local\inputs.conf

[udp://514]
disabled = false

I restarted Splunk and still no data. Anyone have luck with this? I am on Splunk 5 and the overview states it is supported.

Re: Manually created inputs.conf and still no data

yannK — Wed, 13 Nov 2013 23:20:05 GMT

Here are some basic questions :

Is the port udp 514 open on your firewall ?
Is the port udp 514 reserved for another process ? on linux check with lsof -i udp:514
On linux, is Splunk running as root ( ports under 1024 are reserved for root processes only) see http://answers.splunk.com/answers/63898/how-to-listen-to-port-udp-514-when-splunk-is-not-root

topic Manually created inputs.conf and still no data in Getting Data In

Manually created inputs.conf and still no data

Re: Manually created inputs.conf and still no data