UDP data post - What Capabaility should be selected for a user to post data via UDP in splunk ?

[xbbj3nj]

We have a java SDK program to post the data via UDP to index it in splunk.
The connection string (userid,password to connect splunk) right now we have is based on admin role, we don't have any issues in posting data to splunk.

But if I create a native user and role and select custom capabilities like edit_tcp,edit_udp,edit_websettings,input_file,output_file,rest_properties_get,rest_properties_set,use it as connection string the SDK fails and throws fata error like below:
[Fatal Error] :-1:-1: Premature end of file.[Fatal Error] :-1:-1: Premature end of file.
Any thoughts please ? Whether any additional capablity should be added ? How can I avoid cloning a admin role in this case...

[Ayn]

UDP inputs do not have any concepts involving authentication at all. You send stuff to port UDP/514 and Splunk will index it, that's it. I'm not sure how you're trying to use the SDK in all this, or connection strings for connecting to Splunk for that matter - these credentials are to be used when you use the SDK for communicating with splunkd over port 8089, not for sending syslog on port 514.

[xbbj3nj]

That's what the SDK looks like, Im connecting to splunk 8089 ,putting data in a UDP port defined, so that it indexes data in the index created in splunk(mentioned in port definiton)

[xbbj3nj]

UdpInput myInput = (UdpInput) splunkService.getInputs().get(objSplunkUDPPort.toString());
public static void main (String args[]) {
try {
Service splunkService = connectAndLoginToSplunkServer("splunk.net","8089","user","user123");
UdpInput myInput = (UdpInput) splunkService.getInputs().get("5555");
System.out.println("myInput ==>"+myInput.getHost());
} catch (Exception e) {
e.printStackTrace();
}
}
}

[Ayn]

So what does the UDP connection have to do with it? What are you trying to achieve?

[xbbj3nj]

I use splunkd port :8089 to connect. Thats why I use an authentication