Getting Data In

Get data from forward TCP and UDP ports

king311
Loves-to-Learn

Not getting data ofter configuring TCP 80 port in inputs.conf

my stanza is like this

[tcp://80]
connection_host = dns
index = port
sourcetype = syslog

can you give me any idea on this. thnks in advance.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

If you are using port less or equal than 1024 then you must run splunkd as root, which is not as best practices. I prefer to use e.g. port 1514 or similar for that. 

Have you update also your senders to use that unstandardised port (normally udp + 514) to use?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...