UDP Data Input receive but not indexed

[nhurtaud]

Hi everyone,

I have some problem with data input on UDP port
I send from a log collector syslog messages.
These are bein received by the splunk host (tcpdump capture) but not indexed.
Data input is well configured (when i use netcat for send messages from log collector to data input, these messages are well-indexed).

I changed some parameters like queue (IndexQueue) to bypass transforms but it's not resolved this issue. Also, i try to change SHOULD_LINEMERGE to false.

If someone has an idea or has encountered this problem?

Thank you and have a nice day.
Nicolas HURTAUD

[mlf]

I've hit this issue multiple times and still haven't found the cause. It seems to happen randomly and is source specific. For example, if my input is on udp:9999, and I have 10 hosts logging, one host's logs will stop getting indexed. Other hosts, even those coming from the same subnet as the missing host, will be fine. In my case, recycling the indexer will normally solve it for the short term.

I'm currently still running 4.3.6. Has anyone seen this in 5.x? Anyone have a clue as to the cause?

[yannK · Accepted solution]

Double check that splunk is listening to the port with netstat, disable any iptables.

If you are on linux and your syslog device uses ip spoofing, check this answer.
http://splunk-base.splunk.com/answers/12876/splunk-running-on-my-linux-server-is-only-showing-me-eve...