Getting Data In

SplunkUniversalForwarder & UDP transfer

Vladimir
Path Finder

Hey!

Is it possible to configure SplunkUniversalForwarder to receive data by udp and send this data to indexer? How?

In my forwarder's inputs.conf

[udp://:9999]
index = myindex
source = mysource
sourcetype = mysource

Output is also configured, i'm pulling wmi data within it. But when I'm sending data to forwarder's udp port I cannot see it in indexer. What am I doing wrong?

Thanks

Tags (1)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You should be able to collect udp data from the forwarder and send it to the indexer. There aren't any constraints on types of data that can be forwarded. I would check splunkd.log to look for connection information from the forwarder to the indexer, and also check splunkd.log on the indexer to ensure you are getting a connection. If a failure is occurring, you should be able to determine why by looking at the log. Have you checked metrics.log via the indexers search? Something like this might be helpful:

index=_internal group="per_source_thruput" NOT series="*splunk/var/log*" | eval mb=kb/1024| timechart span=1d sum(mb) by series

index=_internal group="per_sourcetype_thruput" NOT series="splunk*" | eval mb=kb/1024| timechart span=1d sum(mb) by series 

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

You should be able to collect udp data from the forwarder and send it to the indexer. There aren't any constraints on types of data that can be forwarded. I would check splunkd.log to look for connection information from the forwarder to the indexer, and also check splunkd.log on the indexer to ensure you are getting a connection. If a failure is occurring, you should be able to determine why by looking at the log. Have you checked metrics.log via the indexers search? Something like this might be helpful:

index=_internal group="per_source_thruput" NOT series="*splunk/var/log*" | eval mb=kb/1024| timechart span=1d sum(mb) by series

index=_internal group="per_sourcetype_thruput" NOT series="splunk*" | eval mb=kb/1024| timechart span=1d sum(mb) by series 

Vladimir
Path Finder

Thanks. I've checked it, there wasn't any failures in log so it wasn't a splunk problem. The problem was in firewall rules.

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...