Manually created inputs.conf and still no data

[kluey]

I installed the add-on and tried to follow the directions. After installing, there was no 'Set up' as stated in the readme file, so I manually created the inputs.conf and added lines below (Note: These are the only lines in the inputs.conf file):

\Splunk\etc\apps\Splunk_Ciscofirewalls\local\inputs.conf

[udp://514]
disabled = false

I restarted Splunk and still no data. Anyone have luck with this? I am on Splunk 5 and the overview states it is supported.

[yannK]

Here are some basic questions :

• Is the port udp 514 open on your firewall ?
• Is the port udp 514 reserved for another process ? on linux check with lsof -i udp:514
• On linux, is Splunk running as root ( ports under 1024 are reserved for root processes only) see http://answers.splunk.com/answers/63898/how-to-listen-to-port-udp-514-when-splunk-is-not-root