Security
Highlighted

Syslogs are not shown

Engager

Hello, I am testing Splunk, I have created a Data Input for UDP port 514, but there are no entries in the index. I have checked with a port analyzer and Syslogs from network hosts are being received. Do you have any idea about what could be the problem?

Regards

Tags (3)
0 Karma
Highlighted

Re: Syslogs are not shown

Champion

What do you mean when you say you have checked with a port analyzer?
Some things I would check;

  • That there is an exception on the machine for UDP port 514 for any firewall software that may be running
  • The syslog server is correctly configured and isn't perhaps forwarding from any other port. By default it should be 514 on most standard syslog servers and will work with a line like...
*.*    @SPLUNKIP
  • Have you tried a search for the host ip on the splunk server? Just incase it's not indexing them where you think it may be putting them
0 Karma