Getting Data In

How to verify if Splunk Forwarder is receiving the data on a UDP port

ssankeneni
Communicator

How can I verify if my universal forwarder is receiving the data on the UDP port ? I don't see any thing in my splunkd logs.

0 Karma

Ayn
Legend

Easiest is to run something like tcpdump, Wireshark or similar and see if traffic flows in on the port.

0 Karma

Ayn
Legend

index=_internal group=per_source_thruput series=udp:514

ssankeneni
Communicator

I don't have access to the machine to install any new rpms. Can you please let me know is there any way i could find it through Splunk.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!