How do I identify UDP source on Splunk Indexer?

[congoland]

I'm fairly new to Splunk and inherited a messy environment. I'm trying to dissect log sources. I have 3 indexers that are receiving UDP logs and placing them in an index named "firewall" and am trying to figure out the UDP source so I can turn off logging.

When I search against the firewall index, I get multiple hosts but the source is always the same:
source = udp:11514

I checked the data inputs but don't see this UDP port defined with the specific firewall index name. What's the best way to determine where these UDP logs are coming from? It's possible that there's a rogue heavy forwarder that's sending them. Assume nothing's documented and best practices were not followed during configuration. Thank you.

[rg33]

Are you using the CLI to show inputs? Try:

splunk cmd btool inputs list --debug

or this search processing language (SPL) for each forwarder:

| rest https://<forwarder-ip-address>:8089 /services/data/inputs/monitor

Maybe one of these will help track it down.

Or, if you want you can check the indexer listening ports, and run tcpdump to listen for incoming traffic. Here are some commands to help that:

netstat -aln |grep LISTEN
tcpdump -lnn port 11514

Hope this helps.

/rg