Setting up Splunk receiver through TCP/IP

[Caio_Santos]

Hey everybody,

I'm going through some problems trying to set my receiver splunk instance. I performed exactely the ways which is described on the documantation, although Im still getting one error when I attempt to save my new date TCP input.

That's the error:

Encountered the following error while trying to save: In handler 'raw': TCP port 333 is not available.

As I said before, I followed each step on the docs, but for sure I'm missing something. I am sorry if I am being an ignorant, but I'm just starting with splunk.

Thank you in advance.

[southeringtonp · Accepted solution]

Is something else running on port 333 already? At the command line, try running netstat -an to check.

Also, if you are running Splunk as a non-root user, Splunk will not be able to bind to ports below 1024, as those ports are considered privileged.

Do you have the same problem with other port numbers, especially with port numbers above 1024?

[Genti · Accepted solution]

Caio, is this on a unix box?
If so, there might be a permission issue as only root can open ports under 1024.
You can try listening to tcp on a higher port, say 9001. Let us know if you get similar errors then.
Cheers,
.gz

[southeringtonp · Accepted solution]

Is something else running on port 333 already? At the command line, try running netstat -an to check.

Also, if you are running Splunk as a non-root user, Splunk will not be able to bind to ports below 1024, as those ports are considered privileged.

Do you have the same problem with other port numbers, especially with port numbers above 1024?