Getting Data In

SplunkUniversalForwarder & UDP transfer

Path Finder

Hey!

Is it possible to configure SplunkUniversalForwarder to receive data by udp and send this data to indexer? How?

In my forwarder's inputs.conf

[udp://:9999]
index = myindex
source = mysource
sourcetype = mysource

Output is also configured, i'm pulling wmi data within it. But when I'm sending data to forwarder's udp port I cannot see it in indexer. What am I doing wrong?

Thanks

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

You should be able to collect udp data from the forwarder and send it to the indexer. There aren't any constraints on types of data that can be forwarded. I would check splunkd.log to look for connection information from the forwarder to the indexer, and also check splunkd.log on the indexer to ensure you are getting a connection. If a failure is occurring, you should be able to determine why by looking at the log. Have you checked metrics.log via the indexers search? Something like this might be helpful:

index=_internal group="per_source_thruput" NOT series="*splunk/var/log*" | eval mb=kb/1024| timechart span=1d sum(mb) by series

index=_internal group="per_sourcetype_thruput" NOT series="splunk*" | eval mb=kb/1024| timechart span=1d sum(mb) by series 

View solution in original post

Splunk Employee
Splunk Employee

You should be able to collect udp data from the forwarder and send it to the indexer. There aren't any constraints on types of data that can be forwarded. I would check splunkd.log to look for connection information from the forwarder to the indexer, and also check splunkd.log on the indexer to ensure you are getting a connection. If a failure is occurring, you should be able to determine why by looking at the log. Have you checked metrics.log via the indexers search? Something like this might be helpful:

index=_internal group="per_source_thruput" NOT series="*splunk/var/log*" | eval mb=kb/1024| timechart span=1d sum(mb) by series

index=_internal group="per_sourcetype_thruput" NOT series="splunk*" | eval mb=kb/1024| timechart span=1d sum(mb) by series 

View solution in original post

Path Finder

Thanks. I've checked it, there wasn't any failures in log so it wasn't a splunk problem. The problem was in firewall rules.

0 Karma