Getting Data In

SplunkUniversalForwarder & UDP transfer

Vladimir
Path Finder

Hey!

Is it possible to configure SplunkUniversalForwarder to receive data by udp and send this data to indexer? How?

In my forwarder's inputs.conf

[udp://:9999]
index = myindex
source = mysource
sourcetype = mysource

Output is also configured, i'm pulling wmi data within it. But when I'm sending data to forwarder's udp port I cannot see it in indexer. What am I doing wrong?

Thanks

Tags (1)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You should be able to collect udp data from the forwarder and send it to the indexer. There aren't any constraints on types of data that can be forwarded. I would check splunkd.log to look for connection information from the forwarder to the indexer, and also check splunkd.log on the indexer to ensure you are getting a connection. If a failure is occurring, you should be able to determine why by looking at the log. Have you checked metrics.log via the indexers search? Something like this might be helpful:

index=_internal group="per_source_thruput" NOT series="*splunk/var/log*" | eval mb=kb/1024| timechart span=1d sum(mb) by series

index=_internal group="per_sourcetype_thruput" NOT series="splunk*" | eval mb=kb/1024| timechart span=1d sum(mb) by series 

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You should be able to collect udp data from the forwarder and send it to the indexer. There aren't any constraints on types of data that can be forwarded. I would check splunkd.log to look for connection information from the forwarder to the indexer, and also check splunkd.log on the indexer to ensure you are getting a connection. If a failure is occurring, you should be able to determine why by looking at the log. Have you checked metrics.log via the indexers search? Something like this might be helpful:

index=_internal group="per_source_thruput" NOT series="*splunk/var/log*" | eval mb=kb/1024| timechart span=1d sum(mb) by series

index=_internal group="per_sourcetype_thruput" NOT series="splunk*" | eval mb=kb/1024| timechart span=1d sum(mb) by series 

Vladimir
Path Finder

Thanks. I've checked it, there wasn't any failures in log so it wasn't a splunk problem. The problem was in firewall rules.

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...