Splunk Search

UDP Data Input receive but not indexed

nhurtaud
Explorer

Hi everyone,

I have some problem with data input on UDP port
I send from a log collector syslog messages.
These are bein received by the splunk host (tcpdump capture) but not indexed.
Data input is well configured (when i use netcat for send messages from log collector to data input, these messages are well-indexed).

I changed some parameters like queue (IndexQueue) to bypass transforms but it's not resolved this issue. Also, i try to change SHOULD_LINEMERGE to false.

If someone has an idea or has encountered this problem?

Thank you and have a nice day.
Nicolas HURTAUD

Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

Double check that splunk is listening to the port with netstat, disable any iptables.

If you are on linux and your syslog device uses ip spoofing, check this answer.
http://splunk-base.splunk.com/answers/12876/splunk-running-on-my-linux-server-is-only-showing-me-eve...

View solution in original post

0 Karma

mlf
Path Finder

I've hit this issue multiple times and still haven't found the cause. It seems to happen randomly and is source specific. For example, if my input is on udp:9999, and I have 10 hosts logging, one host's logs will stop getting indexed. Other hosts, even those coming from the same subnet as the missing host, will be fine. In my case, recycling the indexer will normally solve it for the short term.

I'm currently still running 4.3.6. Has anyone seen this in 5.x? Anyone have a clue as to the cause?

0 Karma

yannK
Splunk Employee
Splunk Employee

Double check that splunk is listening to the port with netstat, disable any iptables.

If you are on linux and your syslog device uses ip spoofing, check this answer.
http://splunk-base.splunk.com/answers/12876/splunk-running-on-my-linux-server-is-only-showing-me-eve...

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...