Getting Data In

Trouble getting data to indexer from fortigate

jibin1988
Path Finder

I am not getting data to my indexer(centos) from fortigate firewall. Port 514 is open but i am unable to telnet. Is there any config file i need to edit to receive data?

Tags (1)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @jibin1988,

Please refer https://docs.splunk.com/Documentation/Splunk/6.6.3/Data/Monitornetworkports for configuration of UDP port on splunk indexer side but you need to keep in mind that if you are running splunk with any user (except root) then splunk will not able to occupy 514 port because only root user can access ports below 1024 in this case either you need send UDP traffic on >1024 from fortigate or you need to do configuration in iptables to map port <1024 with port >1024.

I hope this helps.

Thanks,
Harshil

View solution in original post

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @jibin1988,

Please refer https://docs.splunk.com/Documentation/Splunk/6.6.3/Data/Monitornetworkports for configuration of UDP port on splunk indexer side but you need to keep in mind that if you are running splunk with any user (except root) then splunk will not able to occupy 514 port because only root user can access ports below 1024 in this case either you need send UDP traffic on >1024 from fortigate or you need to do configuration in iptables to map port <1024 with port >1024.

I hope this helps.

Thanks,
Harshil

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...