Getting Data In

Two types of data over the same port?

paulgo
Explorer

I'm trying to get both JSON and syslog information from our firewall into Splunk Cloud using universal forwarder.  

So far I've gotten the JSON in by getting splunk to listen to port 514, forward that to the index, and then adding it using 

splunk add udp 514 -sourcetype JSON

However, now I want to add the syslog information as well, which comes over the same port.  When I attempt to add that I get an error:

splunk add udp 514 -sourcetype syslog
Parameter name: UDP port 514 is not available.

How do I get the splunk index to read both from the same port?

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

In short, you can't.  You've already "used up" port 514 with JSON data so you can't also use it for syslog.

Splunk recommends against ingesting TCP or UDP data directly as data will be lost whenever Splunk restarts.

The preferred way to ingest syslog data is to stand up a dedicated syslog server (syslog-ng or rsyslog) and have that server forward (using a UF) to Splunk.  Alternatively, you can use the Splunk Connect for Syslog (SC4S) app to do both.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

In short, you can't.  You've already "used up" port 514 with JSON data so you can't also use it for syslog.

Splunk recommends against ingesting TCP or UDP data directly as data will be lost whenever Splunk restarts.

The preferred way to ingest syslog data is to stand up a dedicated syslog server (syslog-ng or rsyslog) and have that server forward (using a UF) to Splunk.  Alternatively, you can use the Splunk Connect for Syslog (SC4S) app to do both.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...