i have had splunk working earlier when it was installed on a Ubuntu release, no i am trying it on a vm .ova file
Splunk Version 3.4.4 Dec. 7, 2018
Pfsens is 2.4.4
The problem I have is that no logs are coming into Splunk, i have set up pfsense to send the log file to a remote syslog server.
Splunk has been set up to lisen on port 7001 and 7002 upd
Netstat
udp 0 0 0.0.0.0:7001 0.0.0.0:* 5347/splunkd
udp 0 0 0.0.0.0:7002 0.0.0.0:* 5347/splunkd
if i try telnet to localhost on ports 7001 and 7002 i get no rute to host
[splunk@localhost splunk]$ telnet localhost 7001
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused
Trying ::1...
telnet: connect to address ::1: No route to host
[splunk@localhost splunk]$
If you telnet to the syslog server will it not give you a connection?
if i try using syslog test message utility it will not show any thing in Splunk.
Any ideas what so can be wrong ??
Found the error iptables was on solution was sudo iptables -I INPUT -p udp --dport 7001 -j ACCEPT
