Getting Data In

4.2 UDP input with source IP: not working?

twinspop
Influencer

EDIT: I've discovered this only happens if I specify more than one stanza on the same port -- different remote IPs, same UDP port. The way I read the docs, it sounded like you could overload a port by specifying the remote IPs. Is that not the case?

[udp://10.1.168.158:7901]
host = myhostname
sourcetype = syslog

Doesn't work. Am I m issing something? If I leave out the source IP specifier it works fine. Attempting to edit this entry in the GUI coughs up an error about the UDP port not being an integer.

Per inputs.conf docs on splunk.com:

[udp://<remote server>:<port>]
* Similar to TCP, except that it listens on a UDP port.
* Configure Splunk to listen on a specific port. 
* If <remote server> is specified, the specified port will only accept data from that server.
* If <remote server> is empty - [udp://<port>] - the port will accept data sent from any server.

tcpdump confirms the source IP and destination port:

14:41:30.773817 xxxxx > xxxxx, ethertype IPv4 (0x0800), length 198: 10.1.168.158.32774 > 10.5.130.206.7901: UDP
Tags (2)
0 Karma

jbsplunk
Splunk Employee
Splunk Employee

I just added the following input on my indexer via inputs.conf:

[udp://10.1.40.16:1514]
source = downvote
sourcetype = downvote

Then I generated 3000 events. Prior to that I had the input set up like this:

[udp://1514]
source = downvote
sourcetype = downvote

My event count is now sitting at 4000 on the 4.2 indexer where I sent the events.

twinspop
Influencer

Change the sourcetype and/or source so you can tell which stanza is providing the data you're seeing. Also, add another stanza with a different remote IP (and souretype/source). The remote IP specific entries will go dormant.

0 Karma

twinspop
Influencer

Yes, without specifying the remote IP it works.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...