Getting Data In

How to set up splunk to listen to syslog messages coming from hp switches and other network appliances using port UDP 514?

New Member

I am fairly new with Splunk, and I'm trying to set up Splunk to listen to UDP 514 for syslog messages. Can anyone explain in simple words, how to do this, and if you could list the steps?

thanks

Tags (3)
0 Karma

SplunkTrust
SplunkTrust

See http://docs.splunk.com/Documentation/Splunk/6.3.2/Data/Monitornetworkports

---
If this reply helps you, an upvote would be appreciated.

New Member

Following the instructions, it created the following line syntax:

search source="udp:514" index="history" sourcetype="Network Switches"

How long does it normally takes for data to start to appear. Several of my network switches have been setup to send logging information to the Splunk Server.

Thanks

0 Karma

SplunkTrust
SplunkTrust

The search will display data within seconds of it being indexed by Splunk. The key factor is how often your network switches send log info. If data doesn't appear, check your firewall(s).

---
If this reply helps you, an upvote would be appreciated.
0 Karma