OWL Sender Add-on is not sending data to UDP port

ramkala · ‎02-01-2024

HF1 is with sender Add-on and configured outputs.conf with udp and input ip interface (default configurations) - Not working

We have checked the connectivity with command "nc -vzu host port " the udp port and its showing open

any ideas !!!

PickleRick · ‎02-01-2024

OK. What is "not working"?

Since this is UDP-based, the network-level diagnostics is relatively hard with normal tools, you should rather configure it, try to use it and sniff the network traffic to see if anything is being sent.

OWL Sender Add-on is not sending data to UDP port

heavy forwarder

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

OWL Sender Add-on is not sending data to UDP port

heavy forwarder

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...