Getting Data In

How do I get Splunk to forward syslogs from a certain host to a different Index using the Web GUI?

sworton
Explorer

Hi,

How do I get Splunk to forward syslogs from a certain host to a different Index using the Web GUI?

They are all coming in on port UDP 514 from a Windows forwarder. I want all of this in main apart from syslogs from a certain IP which I want to go into a new index.

It seems to keep complaining that port 514 is already in use which it is but I want

all hosts UDP\514 > main index
x.x.x.x UDP/514 > new index

Thanks for any help, I'm new to this!

Cheers,
Steve.

Tags (1)
0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @sworton

Did either of the answers below solve your problem? If so, please resolve approving one of them. If your problem is still not solved, keep us updated so that someone else can help ya. Thanks!

0 Karma

Rob2520
Communicator
0 Karma

miwade
Engager

I don't know of any way to do this from the GUI. You may need to get into the backend to update the app.

1) Find where your current inputs.conf file is located on the server. The best place to look is /opt/splunk/etc/apps/search/local/input.conf for linux.

2)Find the stanza that starts like this:

[tcp://:514]

3) Above that put in a new stanza that looks like this.

[tcp://<put server ip here>:514]
index = <new index name here>

4) Restart splunk from the webui

You may need to add or removed fields to get the desired results. Here is the documentation page.
http://docs.splunk.com/Documentation/Splunk/7.2.0/Admin/Inputsconf#inputs.conf.example

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...