Getting Data In

Splunk web app not receiving message from client

fortinet1
Explorer

Hi All,

I am new to this splunk community and as such usage of splunk in general. I have a unit which is configured to send syslog to any server. For this purpose I have splunk web app running on a system (Windows 7). The netstat -b -a command shows splunkd and splunkweb running ( LISTENING):

TCP   0.0.0.0:514         abc-PC:0            LISTENING
[splunkd.exe]
TCP   0.0.0.0:8000         abc-PC:0            LISTENING
[splunkweb.exe]
TCP    0.0.0.0:8089         abc-PC:0            LISTENING
[splunkd.exe]
TCP     0.0.0.0:9997        abc-PC:0            LISTENING
[splunkd.exe]
....
...
UDP   0.0.0.0:515            *:*
[splunkd.exe]

The client which is sending the syslog server has IP: 192.168.1.99
The system where my splunk web app (abc-PC) is running has IP: 192.168.0.99 ( both can ping each other)

The client is configured to sent the syslog on port 514. But as you can see from the netstat output, splunk seems to be listening on 514 but log is empty. How to resolve or suggest some ways to proceed in debugging. Also why do I see multiple splunkd.exe running. Is it normal?

Hope to get some suggestions/feedback soon.

THanks

Tags (3)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your netstat suggests that Splunk is listening on UDP port 515 instead of 514. Make sure your syslog sender and Splunk agree on the port number 🙂
Open your Splunk web interface, go to Settings -> Data Inputs -> UDP and tell us what you see.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Your netstat suggests that Splunk is listening on UDP port 515 instead of 514. Make sure your syslog sender and Splunk agree on the port number 🙂
Open your Splunk web interface, go to Settings -> Data Inputs -> UDP and tell us what you see.

martin_mueller
SplunkTrust
SplunkTrust

First you should read and understand this: http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Configurationfiledirectories - the surrounding pages don't hurt either.

Where that UDP input is depends on where you've configured it to be. It'll certainly be in some local directory, because default isn't meant to be changed by the end user.
You could check through all of them, or run this:

$SPLUNK_HOME/bin/splunk cmd btool --debug inputs list udp
0 Karma

fortinet1
Explorer

There are multiple inputs.conf file under
C:/\Program Files/\Splunk/\etc/\apps/\search/\local/\
C:/\Program Files/\Splunk/\etc/\system/\local
C:/\Program Files/\Splunk/\etc/\system/\default
C:/\Program Files/\Splunk/\etc/\apps/\splunk_app_window and so on.

Is there a guide which tells me which input.conf file needs to be changed ?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That depends on what you've set in the corresponding inputs.conf entry.

0 Karma

fortinet1
Explorer

Yes, its been set, Where do I exactly check the logs sent by my syslog sender.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...