How can I determine if the UF is seeing anything on a port?

[paulgo]

I'm trying to get our syslogs forwarded via UF to Splunk Cloud.  I've got the UF listening on port 514 and added 

[udp://514]
connection_host = network
sourcetype = syslog

to the inputs.comf file but I'm not seeing anything in search.  

Is there a way to make sure UF is seeing anything on that port?  Am I missing a step?

[richgalloway]

Splunk Best Practice is to send syslog events to a dedicated syslog server (rsyslog, syslog-ng) and use the UF to forward data from there.  You could use the Splunk Connect for Syslog (SC4S) app to do both of those.

Sending syslog directly to a Splunk instance risks data loss when that instance restarts.

[johnhuang]

This will should you the events and throughput processed per udp inbound port.

index=_internal udpin_connections
| table _time host group sourcePort udp_bps udp_eps udp_kbps udp_kprocessed udp_avg_thruput

[isoutamo]

Are you running splunk on UF as root? When you are using ports below 1024 you must use root not any othe4 users. 
One way to check if this is listening is follow these https://www.cyberciti.biz/faq/unix-linux-check-if-port-is-in-use-command/ instructions.

r. Ismo

[paulgo]

I'm on Windows