Correct format for specifying network inputs

[termcap]

Hi,

The Splunk documentation for inputs.conf presents the format to add a network input as follows [Notice the ":" before the port number]

[tcp://:9995]
connection_host = dns
sourcetype = log4j
source = tcp:9995

 I went ahead and added a network input from Splunk Web and checked the inputs.conf file and found a different format as shown below. [Notice the lack of ":" before 1333]

[tcp://1333]
connection_host = dns
host = splunk-indx1
sourcetype = log4php

 So what is the appropriate format ?

Thanks,

Termcap

[venkatasri]

Hi @termcap 

An example from inputs.conf spec below, however i find your both settings should work fine.

# The following configuration listens on TCP port 9995 for raw
# data from ANY remote server. The host of the data is set as the host name of
# the remote server.  All data will also be assigned the sourcetype "log4j" and
# the source "tcp:9995".
[tcp://:9995]
connection_host = dns
sourcetype = log4j
source = tcp:9995

-----

An upvote would be appreciated if it helps!

[termcap]

Hi @venkatasri, I think both are indeed working fine, but I'm just wondering what is the reason for the difference in the documentation and the way Splunk web writes the configuration file when a network input is added.

[venkatasri]

Could be a backward compatibility they both are same without remote_server port just listens on every host available that's the purpose.