SplunkUniversalForwarder & UDP transfer

[Vladimir]

Hey!

Is it possible to configure SplunkUniversalForwarder to receive data by udp and send this data to indexer? How?

In my forwarder's inputs.conf

[udp://:9999]
index = myindex
source = mysource
sourcetype = mysource

Output is also configured, i'm pulling wmi data within it. But when I'm sending data to forwarder's udp port I cannot see it in indexer. What am I doing wrong?

Thanks

[jbsplunk · Accepted solution]

You should be able to collect udp data from the forwarder and send it to the indexer. There aren't any constraints on types of data that can be forwarded. I would check splunkd.log to look for connection information from the forwarder to the indexer, and also check splunkd.log on the indexer to ensure you are getting a connection. If a failure is occurring, you should be able to determine why by looking at the log. Have you checked metrics.log via the indexers search? Something like this might be helpful:

index=_internal group="per_source_thruput" NOT series="*splunk/var/log*" | eval mb=kb/1024| timechart span=1d sum(mb) by series

index=_internal group="per_sourcetype_thruput" NOT series="splunk*" | eval mb=kb/1024| timechart span=1d sum(mb) by series 

[Vladimir]

Thanks. I've checked it, there wasn't any failures in log so it wasn't a splunk problem. The problem was in firewall rules.