Getting Data In

Why are new UDP data inputs for multiple hosts initially disabled after creation?

xxyz
Explorer

Creating new UDP Data Inputs for received syslog data from specific hosts to go to a specific Index. After creating the data input with multiple hosts (comma delimited) the status is initially disabled. I have no problem enabling afterwards, but wondering if multiple hosts aren't allowed and that is why it is disabled or is it just a precaution?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yeah, inputs.conf

0 Karma

xxyz
Explorer

so i added them all in. no problems. they show up in the gui just fine. however...

when i set a stanza to collect all syslog traffic and direct it to index 'syslog', it doesn't show in the gui. so will this work even though it's not showing?

[udp:514]
index = syslog
sourcetype = syslog
connection_host = ip

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Did you bump Splunk after making the change in the .conf file? Either by restarting or by hitting this URL:

http://your_host:8000/en-US/debug/refresh?entity=admin/conf-inputs
0 Karma

xxyz
Explorer

interesting. normally configurations adding in the gui update conf files under local, but these additions do not.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

All UI settings must appear under local directories, else they would be lost on an upgrade of Splunk.
Make sure you've not just checked the wrong app and keep system/local in mind.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How are you creating the inputs?

0 Karma

xxyz
Explorer

through the gui: settings > data inputs > > udp > new

is there a conf to do this?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...