Getting Data In

Trouble getting data to indexer from fortigate

jibin1988
Path Finder

I am not getting data to my indexer(centos) from fortigate firewall. Port 514 is open but i am unable to telnet. Is there any config file i need to edit to receive data?

Tags (1)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @jibin1988,

Please refer https://docs.splunk.com/Documentation/Splunk/6.6.3/Data/Monitornetworkports for configuration of UDP port on splunk indexer side but you need to keep in mind that if you are running splunk with any user (except root) then splunk will not able to occupy 514 port because only root user can access ports below 1024 in this case either you need send UDP traffic on >1024 from fortigate or you need to do configuration in iptables to map port <1024 with port >1024.

I hope this helps.

Thanks,
Harshil

View solution in original post

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @jibin1988,

Please refer https://docs.splunk.com/Documentation/Splunk/6.6.3/Data/Monitornetworkports for configuration of UDP port on splunk indexer side but you need to keep in mind that if you are running splunk with any user (except root) then splunk will not able to occupy 514 port because only root user can access ports below 1024 in this case either you need send UDP traffic on >1024 from fortigate or you need to do configuration in iptables to map port <1024 with port >1024.

I hope this helps.

Thanks,
Harshil

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...