Getting Data In

Get data from forward TCP and UDP ports

king311
Loves-to-Learn

Not getting data ofter configuring TCP 80 port in inputs.conf

my stanza is like this

[tcp://80]
connection_host = dns
index = port
sourcetype = syslog

can you give me any idea on this. thnks in advance.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

If you are using port less or equal than 1024 then you must run splunkd as root, which is not as best practices. I prefer to use e.g. port 1514 or similar for that. 

Have you update also your senders to use that unstandardised port (normally udp + 514) to use?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...