All Apps and Add-ons

No 'data activity' in A10 index

edwinmae
Path Finder

alt text


According to our Infra specialist, there are (incoming) packets from A10 through Eth1 (interface)

UDP port has been configured under 'Data inputs' and this port (also) shows in the server

Index shows no events


What am I missing here?

0 Karma

jmallorquin
Builder

Hi,

Verify that the data input points to that index and is enable.
Verify that the port can be open by splunk user, its mean that if splunk is running with not root user, all ports under 1024 are forbiden.
Verify with telnet from the server that you can open a connection localyt to that port.

Hope i help you

0 Karma

edwinmae
Path Finder

Splunk server:
The Data Inputs has been configured for UDP port 1514
Source Type = a10 (chosen from List)
More settings : Set host = IP / Index = a10networks / Restrict to Host = 'empty'

Props.conf (under default) has been updated for port 1514

Linux server:
udp 0 0 xxx.xxx.xxx.xxx:1514 0.0.0.0:*

As it's an UDP port, telnet propably doens't work ...

0 Karma

jmallorquin
Builder

Hi,

You can verify that the port is LISTEN

netstat

Hope i help you

0 Karma

edwinmae
Path Finder

I am using netstat -- It's an UDP Port -- UDP port doesn't show as LISTENING like TCP port

0 Karma

jmallorquin
Builder

Review this to probe.

link text

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...