Syslogs are not shown


Hello, I am testing Splunk, I have created a Data Input for UDP port 514, but there are no entries in the index. I have checked with a port analyzer and Syslogs from network hosts are being received. Do you have any idea about what could be the problem?


Tags (3)
0 Karma


What do you mean when you say you have checked with a port analyzer?
Some things I would check;

  • That there is an exception on the machine for UDP port 514 for any firewall software that may be running
  • The syslog server is correctly configured and isn't perhaps forwarding from any other port. By default it should be 514 on most standard syslog servers and will work with a line like...
*.*    @SPLUNKIP
  • Have you tried a search for the host ip on the splunk server? Just incase it's not indexing them where you think it may be putting them
0 Karma