How do I debug inbound syslog that isn't getting indexed by Splunk?

[danfein]

Hi I currently have tried a lot of things but can't seem to get the data into Splunk.

I have a server sending syslog messages to my desktop.
The connection is seen on wireshark/tcpdump, so that's successful.
I have set up Add Data via Monitor for TCP 514.
I have tried a blank search and one for index=* and nothing is showing up in Splunk.
There is no intermediary device between the syslog sender and our Splunk desktop.

Any idea what could be the problem with the syslog?

[jkat54]

Is splunk able to bind to the port? netstat -an will work in windows and linux command line and it will show if 0.0.0.0:514 is LISTENING or not.

Sometimes its shown as *:514, or [YOUR_IP_ADDRESS]:514

If splunk is running on linux, it needs root permission to bind to 514. Try using 5514 instead of giving splunk root permissions.

[danfein]

Hi jkat,

Yes it does seem to be binding. Still no luck. Any other thoughts here?

netstat -an | grep 514
tcp 0 0 0.0.0.0:5514 0.0.0.0:* LISTEN

tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN

[jkat54]

How much data have you tested with? There is a queue on tcp/udp inputs that doesnt flush to disk until it fills.