Getting Data In

splunk add forward-server IP:PORT -auth user:pass - For UDP ???

New Member

Hi,

Please i need to use de UDP protocol to add Forwarders (Universal in my case) buy supoust its de same command working with another options of "forwarders"..

splunk add forward-server IP:PORT -auth user:pass

¿what is de sintaxis?

thanks

Tags (1)
0 Karma

New Member

Hi,

I don't need to use UDP ... it's only to keep the same way UDP/514. But really... i don't need it - i will create a recibe data port tcp/514.

thanks

0 Karma

Legend

No, forwarding from a Splunk instance to another cannot use UDP. Why would you need UDP?

If you really can't do this via TCP, you'll have to resort to sending syslog over UDP from the forwarder to the indexer.

Legend

Righty. By the way, the best thing would be to use Splunk's own protocol for forwarding events from one Splunk instance to another (splunktcp) rather than just sending the raw data (tcp).

0 Karma

New Member

Hi,

I don't need to use UDP ... it's only to keep the same way UDP/514. But really... i don't need it - i will create a recibe data port tcp/514.

thanks

0 Karma

Ultra Champion

and that would not be a good idea, since you'd then be limited to standard syslog limits (<1k message size, single line). Try to fit a stacktrace, or eventlog message into that... 🙂

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!