Getting Data In

Splunk web app not receiving message from client

fortinet1
Explorer

Hi All,

I am new to this splunk community and as such usage of splunk in general. I have a unit which is configured to send syslog to any server. For this purpose I have splunk web app running on a system (Windows 7). The netstat -b -a command shows splunkd and splunkweb running ( LISTENING):

TCP   0.0.0.0:514         abc-PC:0            LISTENING
[splunkd.exe]
TCP   0.0.0.0:8000         abc-PC:0            LISTENING
[splunkweb.exe]
TCP    0.0.0.0:8089         abc-PC:0            LISTENING
[splunkd.exe]
TCP     0.0.0.0:9997        abc-PC:0            LISTENING
[splunkd.exe]
....
...
UDP   0.0.0.0:515            *:*
[splunkd.exe]

The client which is sending the syslog server has IP: 192.168.1.99
The system where my splunk web app (abc-PC) is running has IP: 192.168.0.99 ( both can ping each other)

The client is configured to sent the syslog on port 514. But as you can see from the netstat output, splunk seems to be listening on 514 but log is empty. How to resolve or suggest some ways to proceed in debugging. Also why do I see multiple splunkd.exe running. Is it normal?

Hope to get some suggestions/feedback soon.

THanks

Tags (3)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your netstat suggests that Splunk is listening on UDP port 515 instead of 514. Make sure your syslog sender and Splunk agree on the port number 🙂
Open your Splunk web interface, go to Settings -> Data Inputs -> UDP and tell us what you see.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Your netstat suggests that Splunk is listening on UDP port 515 instead of 514. Make sure your syslog sender and Splunk agree on the port number 🙂
Open your Splunk web interface, go to Settings -> Data Inputs -> UDP and tell us what you see.

martin_mueller
SplunkTrust
SplunkTrust

First you should read and understand this: http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Configurationfiledirectories - the surrounding pages don't hurt either.

Where that UDP input is depends on where you've configured it to be. It'll certainly be in some local directory, because default isn't meant to be changed by the end user.
You could check through all of them, or run this:

$SPLUNK_HOME/bin/splunk cmd btool --debug inputs list udp
0 Karma

fortinet1
Explorer

There are multiple inputs.conf file under
C:/\Program Files/\Splunk/\etc/\apps/\search/\local/\
C:/\Program Files/\Splunk/\etc/\system/\local
C:/\Program Files/\Splunk/\etc/\system/\default
C:/\Program Files/\Splunk/\etc/\apps/\splunk_app_window and so on.

Is there a guide which tells me which input.conf file needs to be changed ?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That depends on what you've set in the corresponding inputs.conf entry.

0 Karma

fortinet1
Explorer

Yes, its been set, Where do I exactly check the logs sent by my syslog sender.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...