Getting Data In

Why am I getting "ERROR TcpInputProc - Received unexpected 1380997408 byte message" forwarding my fortigate logs to Splunk?

sympatiko
Communicator

Hi,

I'm just new with splunk. I'm getting this error upon forwarding my fortigate logs to splunk. How can I set splunk to listen on UDP logs?

Thanks

Tags (3)
0 Karma

sympatiko
Communicator

I already fixed the issue by adding an UDP data input config. Now I'm getting this error in the splunkd.logs

ERROR SearchParser - Could not find macro 'fortigate_webfilter' that takes 0 arguments. Expecting stanza name 'fortigate_webfilter'

Any idea?

Thanks,
Eddel

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi sympatiko,

take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/SyslogTCP

cheers, MuS

0 Karma

sympatiko
Communicator

Hi MuS,

Thanks for your help. Are you familiar with this error "Received unexpected 1380997408 byte message (Invalid payload_size=1380997408 received while in parseState=1)!" . As I've understand it pertains to the size being forward by my fortigate firewall,is it? Correct me if I'm wrong.

Thanks for your help!

0 Karma

MuS
SplunkTrust
SplunkTrust

which port are you sending the fortigate stream?

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...