Syslogs are not shown

[gnazer]

Hello, I am testing Splunk, I have created a Data Input for UDP port 514, but there are no entries in the index. I have checked with a port analyzer and Syslogs from network hosts are being received. Do you have any idea about what could be the problem?

Regards

[Drainy]

What do you mean when you say you have checked with a port analyzer?
Some things I would check;

• That there is an exception on the machine for UDP port 514 for any firewall software that may be running
• The syslog server is correctly configured and isn't perhaps forwarding from any other port. By default it should be 514 on most standard syslog servers and will work with a line like...

*.*    @SPLUNKIP

• Have you tried a search for the host ip on the splunk server? Just incase it's not indexing them where you think it may be putting them