Getting Data In

Correct format for specifying network inputs

termcap
Path Finder

Hi,

The Splunk documentation for inputs.conf presents the format to add a network input as follows [Notice the ":" before the port number]

 

[tcp://:9995]
connection_host = dns
sourcetype = log4j
source = tcp:9995

 

 I went ahead and added a network input from Splunk Web and checked the inputs.conf file and found a different format as shown below. [Notice the lack of ":" before 1333]

 

[tcp://1333]
connection_host = dns
host = splunk-indx1
sourcetype = log4php

 

 So what is the appropriate format ?

Thanks,

Termcap

Labels (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @termcap 

An example from inputs.conf spec below, however i find your both settings should work fine.

 

# The following configuration listens on TCP port 9995 for raw
# data from ANY remote server. The host of the data is set as the host name of
# the remote server.  All data will also be assigned the sourcetype "log4j" and
# the source "tcp:9995".
[tcp://:9995]
connection_host = dns
sourcetype = log4j
source = tcp:9995

 

 

-----

An upvote would be appreciated if it helps!

0 Karma

termcap
Path Finder

Hi @venkatasri, I think both are indeed working fine, but I'm just wondering what is the reason for the difference in the documentation and the way Splunk web writes the configuration file when a network input is added.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Could be a backward compatibility they both are same without remote_server port just listens on every host available that's the purpose.  

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...