Getting Data In

No data from TCP input

siva_cg
Path Finder

Hi All,

We have a Splunk environment running on 6.2.2. We configured a TCP input to receive logs directly from network device to Indexer. The configurations are as below:

inputs.conf
[tcp://:11514]
index=x
source=y
sourcetype=z
acceptFrom=IP

I see, all connections are fine and on checking the network logs, I am seeing that Indexer has acknowledged for the data but still I am unable to see the data in Splunk. What could be the issue? could you please help to resolve it? Thanks in advance.
(I have similar configurations for another source and it is working as expected)

0 Karma

mayurr98
Super Champion

You could try tcpdump -i eth0 tcp port 11514 -nn to see if traffic is actually flowing while Splunk is running.

siva_cg
Path Finder

@mayurr98 , I have taken tcpdump and traffic is flowing

0 Karma

solarboyz1
Builder

When you are searching for the event's in Splunk are you using all time or specifying a time range? If a timestamp is not getting parsed from the data correctly, its possible a future or past date is used which will prevent the events from showing up in a time constrained search.

| metadata index=x type=hosts

Do you see the host reporting?

Check to see if the events timestamps are off:

  • The lastTime field is the timestamp for the last time that the indexer saw an event from this host.
  • The recentTime field is the indextime for the most recent time that the index saw an event from this host. In other words, this is the time of the last update
0 Karma

siva_cg
Path Finder

Hi @solarboyz1,
I tried with All Time and future time as well but not luck. This is only source configured to Splunk and not receiving logs

0 Karma

solarboyz1
Builder

Is the index created?

Do you see any error related to this input or index in the _internal logs?

Have you tried using a non-splunk listener (netcat) to verify the format of the data coming in?

0 Karma

DavidHourani
Super Champion

try it without the acceptFrom=IP first to make sure that's not denying anything..

0 Karma

siva_cg
Path Finder

@DavidHourani, I tried but no luck.

0 Karma

DavidHourani
Super Champion

So the port is listening, data is coming in to the port and the remote server is able to connect BUT nothing is going to splunk ?

What's the sourcetype ? Syslog ?

0 Karma

DavidHourani
Super Champion

A good way to debug this is to use another splunk server in the same network zone. Do you have any HF that you can use ? Better if it's a server with nothing going on it, that way you can really understand if you're problem is from your input stanza, from the network or from the source.

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...