All Apps and Add-ons

Splunk for Barracuda Web Application Firewall: Is it OK to change the input source to a new UDP port and sourcetype?

spldalya
New Member

I have my WAF data coming in over a different UDP port with it's own sourcetype. If I change the inputs.conf file to reflect my port and source type, will the app just pick this up when I add the inputs.conf file to the local directory?

Thanks

0 Karma

jeffland
SplunkTrust
SplunkTrust

After a splunk restart, it should.

Keep in mind that if you change the sourcetype, your predefined reports/views might not work if they contain a search for the default sourcetype.

0 Karma

spldalya
New Member

Hi

Thanks for your reply. This is possibly a wider issue with taking in Syslog data from multiple sources and how I, in an attempt to source type the data, have created multiple input sources on udp so now this app is looking for syslog data on the standard port. I thought I could just change the inputs.conf file for the app to point to the unique port. But the transforms do not appear to be working. Any idea how to "debug" an app to see what's actually going on between input and transforms?
Thanks

0 Karma

jeffland
SplunkTrust
SplunkTrust

You'll have to look through the conf files, most notably props.conf (and possibly transforms.conf). Or, if available, check the app's documentation.

Have you tried editing only the port in inputs.conf, without changing any sourcetype assignments? That could save you the hassle.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...