Splunk Search

UDP Data Input receive but not indexed

nhurtaud
Explorer

Hi everyone,

I have some problem with data input on UDP port
I send from a log collector syslog messages.
These are bein received by the splunk host (tcpdump capture) but not indexed.
Data input is well configured (when i use netcat for send messages from log collector to data input, these messages are well-indexed).

I changed some parameters like queue (IndexQueue) to bypass transforms but it's not resolved this issue. Also, i try to change SHOULD_LINEMERGE to false.

If someone has an idea or has encountered this problem?

Thank you and have a nice day.
Nicolas HURTAUD

Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

Double check that splunk is listening to the port with netstat, disable any iptables.

If you are on linux and your syslog device uses ip spoofing, check this answer.
http://splunk-base.splunk.com/answers/12876/splunk-running-on-my-linux-server-is-only-showing-me-eve...

View solution in original post

0 Karma

mlf
Path Finder

I've hit this issue multiple times and still haven't found the cause. It seems to happen randomly and is source specific. For example, if my input is on udp:9999, and I have 10 hosts logging, one host's logs will stop getting indexed. Other hosts, even those coming from the same subnet as the missing host, will be fine. In my case, recycling the indexer will normally solve it for the short term.

I'm currently still running 4.3.6. Has anyone seen this in 5.x? Anyone have a clue as to the cause?

0 Karma

yannK
Splunk Employee
Splunk Employee

Double check that splunk is listening to the port with netstat, disable any iptables.

If you are on linux and your syslog device uses ip spoofing, check this answer.
http://splunk-base.splunk.com/answers/12876/splunk-running-on-my-linux-server-is-only-showing-me-eve...

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...