HF multiple UDP port listening | Best practices

[GaetanVP]

Hello Splunkers,

I have a Splunk HF that will receive multiple logs coming from different machines, all sending via UDP.
I am wondering it I need to configures the external sources to send the logs via UDP but with different port (on port for each sources), or if I can simply tell all my sources to send over UDP port 514 for instance.

I am wondering if the UDP port 514 could become a "network bottleneck" because of too many logs coming from multiple sources on the same port. 

Thanks for your help,

GaetanVP

[gcusello · Accepted solution]

Hi @GaetanVP,

if your data sources permit to configure a different port for each one, it's easier for you because you don't need to manually modify conf files.

But anyway you could also use the same 514 port for all logs and separate data sources based on the ip address, but you need to manually modify conf files because Splunk doesn't permits (via GUI) to add two network data sources using the same port, but it's possible via conf file.

Ciao.

Giuseppe

[GaetanVP]

Hello @gcusello,

Thanks a lot for your answer, that makes total sense.

Regards,
GaetanVP