Two types of data over the same port?

[paulgo]

I'm trying to get both JSON and syslog information from our firewall into Splunk Cloud using universal forwarder.  

So far I've gotten the JSON in by getting splunk to listen to port 514, forward that to the index, and then adding it using 

splunk add udp 514 -sourcetype JSON

However, now I want to add the syslog information as well, which comes over the same port.  When I attempt to add that I get an error:

splunk add udp 514 -sourcetype syslog
Parameter name: UDP port 514 is not available.

How do I get the splunk index to read both from the same port?

[richgalloway · Accepted solution]

In short, you can't.  You've already "used up" port 514 with JSON data so you can't also use it for syslog.

Splunk recommends against ingesting TCP or UDP data directly as data will be lost whenever Splunk restarts.

The preferred way to ingest syslog data is to stand up a dedicated syslog server (syslog-ng or rsyslog) and have that server forward (using a UF) to Splunk.  Alternatively, you can use the Splunk Connect for Syslog (SC4S) app to do both.