Search TCP Data Input

[dbabanov]

Hello!
I adds TCP Data Inputs and indexes the TCP port 80.

I use local forwarder and indexer.

How can i search this logs?
What sourcetype? Syslog?

Sorry, but i can`t find answer..

[dbabanov]

Ok!
But how can i search this log in search-string?

[Ayn]

It depends on what source and sourcetype you chose when setting up the input. source will likely be tcp:80 so:

source=tcp:80

[HiroshiSatoh]

Please check your settings.
Splunk > Manager » Data inputs » TCP

[HiroshiSatoh]

You should have set up sourcetype and host if "TCP Data Inputs". Do you use in any applications "local forwarder"?

Do you find from Hosts summary of the search?
Splunk > Search » Summary » Hosts