Getting Data In

Failed to add the same UDP port

noott211
Path Finder

udp7511 syslog transmission was set up on three firewalls.
The same port is not registered on the splank web.
I used the method below, but it failed. However, logs are sent when set to another port on the splunk web.


/opt/splunk/etc/apps/search/local

[udp://7511]
connection_host = ip
host = 192.168.10.10
index = fw1
source = fw1_source
sourcetype = syslog

[udp://7511]
connection_host = ip
host = 192.168.10.20
index = fw2
source = fw2_source
sourcetype = syslog

[udp://7511]
connection_host = ip
host = 192.168.10.30
index = fw3
source = fw3_source
sourcetype = syslog

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

No. You can't do it this way. If you define a tcp or udp input, splunk binds the port to a given ip (or inaddr_any if you don't specify an address to bind to). Your config would try to define the same input three times. I don't recall at the moment whether it would result in splunk trying three times to bind to the same port (which would fail - you can't listen on the same port more than once) or overwriting subsequent definitions with the last instance. But any way it did, it's definitely not what you want.

Furthermore, splunk's udp input is not a very good way to receive syslog event's (partly because of performance issues, partly because of lack of metadata). You'd be much better off using either sc4s, rsyslogd or some other form of intermediate syslog receiving and processing layer.

But if it's a small installation and you want to stick to builtin inputs only, bind the inputs on different ports.

Oh, and it's worth remembering that udp is unreliable and you might easily be losing events.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...