Splunk web app not receiving message from client

[fortinet1]

Hi All,

I am new to this splunk community and as such usage of splunk in general. I have a unit which is configured to send syslog to any server. For this purpose I have splunk web app running on a system (Windows 7). The netstat -b -a command shows splunkd and splunkweb running ( LISTENING):

TCP   0.0.0.0:514         abc-PC:0            LISTENING
[splunkd.exe]
TCP   0.0.0.0:8000         abc-PC:0            LISTENING
[splunkweb.exe]
TCP    0.0.0.0:8089         abc-PC:0            LISTENING
[splunkd.exe]
TCP     0.0.0.0:9997        abc-PC:0            LISTENING
[splunkd.exe]
....
...
UDP   0.0.0.0:515            *:*
[splunkd.exe]

The client which is sending the syslog server has IP: 192.168.1.99
The system where my splunk web app (abc-PC) is running has IP: 192.168.0.99 ( both can ping each other)

The client is configured to sent the syslog on port 514. But as you can see from the netstat output, splunk seems to be listening on 514 but log is empty. How to resolve or suggest some ways to proceed in debugging. Also why do I see multiple splunkd.exe running. Is it normal?

Hope to get some suggestions/feedback soon.

THanks

[martin_mueller · Accepted solution]

Your netstat suggests that Splunk is listening on UDP port 515 instead of 514. Make sure your syslog sender and Splunk agree on the port number 🙂
Open your Splunk web interface, go to Settings -> Data Inputs -> UDP and tell us what you see.

[martin_mueller]

First you should read and understand this: http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Configurationfiledirectories - the surrounding pages don't hurt either.

Where that UDP input is depends on where you've configured it to be. It'll certainly be in some local directory, because default isn't meant to be changed by the end user.
You could check through all of them, or run this:

$SPLUNK_HOME/bin/splunk cmd btool --debug inputs list udp

[fortinet1]

There are multiple inputs.conf file under
C:/\Program Files/\Splunk/\etc/\apps/\search/\local/\
C:/\Program Files/\Splunk/\etc/\system/\local
C:/\Program Files/\Splunk/\etc/\system/\default
C:/\Program Files/\Splunk/\etc/\apps/\splunk_app_window and so on.

Is there a guide which tells me which input.conf file needs to be changed ?

[martin_mueller]

That depends on what you've set in the corresponding inputs.conf entry.

[fortinet1]

Yes, its been set, Where do I exactly check the logs sent by my syslog sender.