There are buffers for TCP & UDP inputs in Splunk. You'll need to send 0.75 to 1.5 megabytes of data over the port before Splunk will flush from buffer to the index. My guess is you havent sent enough data over the port yet.
Or you can put this on your TCP/UDP input stanza:
_rcvbuf = 0
Example:
[tcp://<remote server>:9514]
...
_rcvbuf = 0
https://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Monitornetworkports
I wouldnt recommend running without a buffer once you have more data coming in. It's there for a reason, and helps tremendously with high volume network inputs.
... View more
