I'm fairly new to Splunk and inherited a messy environment. I'm trying to dissect log sources. I have 3 indexers that are receiving UDP logs and placing them in an index named "firewall" and am trying to figure out the UDP source so I can turn off logging.
When I search against the firewall index, I get multiple hosts but the source is always the same:
source = udp:11514
I checked the data inputs but don't see this UDP port defined with the specific firewall index name. What's the best way to determine where these UDP logs are coming from? It's possible that there's a rogue heavy forwarder that's sending them. Assume nothing's documented and best practices were not followed during configuration. Thank you.