How to get logs for Checkpoint through the UDP port?

[AsafMarxRoz]

Hey hope you can help

i was getting logs for Checkpoint through the UDP port,  we change the IP for the Splunk machine and adjust the endpoint stream in checkpoint to the new IP but then we discover that Splunk doesn't accept UDP from outside his   

[gcusello]

Hi @AsafMarxRoz,

Splunk accepts UDP traffic if you enable it!

you have at first to disable local firewall on the server for this protocol and port and then you have to enable the input in the section [Settings > Inputs > Network Inputs > UDP].

In addition you should check that there isn't any intermediate firewall between Check Point and Splunk.

Ciao.

Giuseppe