Getting Data In

No data from TCP input

siva_cg
Path Finder

Hi All,

We have a Splunk environment running on 6.2.2. We configured a TCP input to receive logs directly from network device to Indexer. The configurations are as below:

inputs.conf
[tcp://:11514]
index=x
source=y
sourcetype=z
acceptFrom=IP

I see, all connections are fine and on checking the network logs, I am seeing that Indexer has acknowledged for the data but still I am unable to see the data in Splunk. What could be the issue? could you please help to resolve it? Thanks in advance.
(I have similar configurations for another source and it is working as expected)

0 Karma

mayurr98
Super Champion

You could try tcpdump -i eth0 tcp port 11514 -nn to see if traffic is actually flowing while Splunk is running.

siva_cg
Path Finder

@mayurr98 , I have taken tcpdump and traffic is flowing

0 Karma

solarboyz1
Builder

When you are searching for the event's in Splunk are you using all time or specifying a time range? If a timestamp is not getting parsed from the data correctly, its possible a future or past date is used which will prevent the events from showing up in a time constrained search.

| metadata index=x type=hosts

Do you see the host reporting?

Check to see if the events timestamps are off:

  • The lastTime field is the timestamp for the last time that the indexer saw an event from this host.
  • The recentTime field is the indextime for the most recent time that the index saw an event from this host. In other words, this is the time of the last update
0 Karma

siva_cg
Path Finder

Hi @solarboyz1,
I tried with All Time and future time as well but not luck. This is only source configured to Splunk and not receiving logs

0 Karma

solarboyz1
Builder

Is the index created?

Do you see any error related to this input or index in the _internal logs?

Have you tried using a non-splunk listener (netcat) to verify the format of the data coming in?

0 Karma

DavidHourani
Super Champion

try it without the acceptFrom=IP first to make sure that's not denying anything..

0 Karma

siva_cg
Path Finder

@DavidHourani, I tried but no luck.

0 Karma

DavidHourani
Super Champion

So the port is listening, data is coming in to the port and the remote server is able to connect BUT nothing is going to splunk ?

What's the sourcetype ? Syslog ?

0 Karma

DavidHourani
Super Champion

A good way to debug this is to use another splunk server in the same network zone. Do you have any HF that you can use ? Better if it's a server with nothing going on it, that way you can really understand if you're problem is from your input stanza, from the network or from the source.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...