Reporting and Management for OSSEC: Is it possible to have multiple OSSEC Masters reporting to the same UDP input in Splunk?

[jamesedwards]

Is it possible to have two different OSSEC masters reporting to the same UDP input in Splunk? In splunk, I have it set to listen on [udp://10002]

Master 1: 10.0.0.101-> 10.0.0.100:10002/udp
Master 2: 10.0.0.102 -> 10.0.0.100:10002/udp

I only see the data from Master 1. Can this work in the above configuration, or would it be best to use multiple ports for multiple inputs?

Thanks

[jamesedwards · Accepted solution]

The answer to this is yes.