All Apps and Add-ons
Highlighted

Not getting any data

New Member

I'm trying to configure UDP Data input, can't configure port 514 and I am not getting any data, can someone help please? I read the README, but still not getting anything. Thanks.

0 Karma
Highlighted

Re: Not getting any data

Splunk Employee
Splunk Employee

Can you elaborate on what the exact steps you took were, and the nature of the failure you encountered? It would be helpful if we could understand the specifics of the problem.

Highlighted

Re: Not getting any data

Builder

Can you confirm if firewall of your platform is disabled and splunk is listening with udp:514?

0 Karma
Highlighted

Re: Not getting any data

New Member

I am getting an error message: port 514 is unavailable. What does this mean? I'm using a trial version. Am I missing a license or permissions?

0 Karma
Highlighted

Re: Not getting any data

Contributor

Here are a few hints, I hope they are helpful.

  1. On your splunk host, ensure that IPTables is not turned on.
  2. From the splunk client, try a UDP nmap command to the host, here is an example nmap -sU -p 9997 -P0 myhost.mydomain.com
  3. On the splunk client run TCPDump to ensure you are seeing the data arrive.

If none of those work, you may want to look at your configuration. Hope that helps.

0 Karma
Highlighted

Re: Not getting any data

New Member

I can get data now with sourcetype syslog in the regular Splunk search using UDP (Port 514)but not in the Juniper SRX dashboard. I read from an answer to another question I should change the sourcetype to srx_log, I changed that under data input but still did not get any traffic.

0 Karma
Highlighted

Re: Not getting any data

New Member

I can get data now with sourcetype syslog in the regular Splunk search using UDP (Port 514)but not in the Juniper SRX dashboard. I read from an answer to another question I should change the sourcetype to srx_log, I changed that under data input but still did not get any traffic.

0 Karma
Highlighted

Re: Not getting any data

New Member

I can get data now with sourcetype syslog in the regular Splunk search using UDP (Port 514)but not in the Juniper SRX dashboard. I read from an answer to another question I should change the sourcetype to srx_log, I changed that under data input but still did not get any traffic.

0 Karma