Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: UPD listening is not receiving events
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
UDP listening is not working on one of my UF's. Have PCAPs confirming the events are successfully making it from the expected source to the system with the UF installed on it. So it is not the sending device and the local firewall on the UF system. Below is the error showing in splunkd log:
12-06-2019 18:02:26.913 +0100 ERROR UDPInputProcessor - Error binding to socket in UDPInputProcessor: The operation completed successfully.
Maybe the account the Splunk Universal Forwarder service is running as does not have the right privileges on the system???
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would guess there is a port conflict. Have you tried changing the port number to something else for your UDP input?
If your UF is on a Linux system, use the following to confirm if the port is being used by another process - https://www.tecmint.com/find-out-which-process-listening-on-a-particular-port/
For windows, use this - https://stackoverflow.com/questions/48198/how-can-you-find-out-which-process-is-listening-on-a-port-...
Please also refer to this post which was answered by @martin_mueller - https://answers.splunk.com/answers/145270/problems-creating-an-udp-input-error-binding-to-socket-in-...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would guess there is a port conflict. Have you tried changing the port number to something else for your UDP input?
If your UF is on a Linux system, use the following to confirm if the port is being used by another process - https://www.tecmint.com/find-out-which-process-listening-on-a-particular-port/
For windows, use this - https://stackoverflow.com/questions/48198/how-can-you-find-out-which-process-is-listening-on-a-port-...
Please also refer to this post which was answered by @martin_mueller - https://answers.splunk.com/answers/145270/problems-creating-an-udp-input-error-binding-to-socket-in-...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Device owner had another application syslog application running and receiving the events. did not communicate this to me until later. configured Splunk to read log files written by their syslog tool. Communication is key!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Best practice for syslog is use a syslog server. Then use a UF to pickup the log files it writes.
Aligning Observability Costs with Business Value: Practical Strategies
Mastering Data Pipelines: Unlocking Value with Splunk
Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0
