Issue getting data in



I have an issue when i try to get data in Splunk 6.2.1
I created /opt/splunk/system/local/inputs.conf but i receive no data.

connection_host = ip
index = firewall

whereas when iadd data from the webUI, there are no issue.
I put only udp://514, i know this is not a connectivity problem.
None of my modifications in the config file are apply when i restart Splunk

I really need help on this.

Thank you

Tags (2)
0 Karma

Path Finder


To add an input by directly editing inputs.conf, add a stanza for the input. You can add the stanza to the inputs.conf file in $SPLUNK_HOME/etc/system/local/, or in your own custom application directory (in $SPLUNK_HOME/etc/apps//local). If you have not worked with Splunk's configuration files before, read "About configuration files" before you begin.

You configure the data input by adding attribute/value pairs to its stanza. You can set multiple attributes in an input stanza. If you do not specify a value for an attribute, Splunk Enterprise uses the default value that's preset in $SPLUNK_HOME/etc/system/default/inputs.conf.

Here's a simple example of adding a network input. This configuration directs Splunk Enterprise to listen on TCP port 9995 for raw data from any remote server. The host of the data is set as the DNS name of the remote server. All data will also be assigned the source type "log4j" and the source "tcp:9995".

connection_host = dns
sourcetype = log4j
source = tcp:9995

For more information, visit:

0 Karma


Hi ThomasLeroy,

adding an IP to this stanza, will not bind UDP input to this IP, but only accept traffic from this IP.
See the docs for more details on this

[udp://<remote server>:<port>]
* If <remote server> is specified, the specified port will only accept data from that server.
* If <remote server> is empty - [udp://<port>] - the port will accept data sent from any server.

cheers, MuS

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>