Thanks @vsingla1 for your support. I'm receiving the logs via udp:514 port by configuring the data input UDP ports. Now a new error is showing here it is Unable to search the indexed data due to license limit violation errors. How can we get back and limit the input data to not to exceed to 500mb per day. ... View more

Hi @vsingla1 thanks for your response. We are almost close to index firewall logs. but a small link is missing somewhere we are unable to find out. The Indexer, UF, searching are in same single Linux server. Rsyslog server is configured in Linux server. Splunk enterprise setup is working fine it is showing the logs only from local Linux server which we have configured UF and Rsyslog server. our Sonicwall firewall logs are also coming to server from firewall. But we are unable to index the files in Splunk. Need support. ... View more

HI @vsingla1 , Thanks for your response. All set in our environment. But one small thing is missing. We have installed Splunk Enterprise& Splunk UF on same Linux server. And configured in our firewall to send the syslogs to same Linux server. Our Splunk indexer is showing the logs of local Linux server logs fine, but unable to display/index the firewalled syslogs. Syslogs from firewall are coming to the device we have done a packet capture test on the server, it showed all the incoming syslog traffic to Linux server. Just a small step away from displaying those logs. but unable to find it. Need support. ... View more

Hi, Will explain briefly once. I've installed Splunk enterprise from Splunk website. I don't have an idea about the component like UF, indexer, search head. Wheather how to find which component is running?? I think it is Indexer which will display log messages. 2.As you suggested to use Linux server for both forward and indexing in the same server or do we need two. If we can install in single Linux server, pls provide any useful link for installation and to add data input. How to configure the inputs.conf file to receive logs from the firewall. Will it update logs dynamically. mail to: [email protected] ... View more

Hi, Thanks for your reply vsingla1. Your answer was helpful somehow. But, I got stuck at data indexing in windows server. My Splunk setup was running on Windows server, Can I install Syslog server in same Windows server. And configure the log directory in "Continuously monitor " in Splunk with UDP port 515. Guide me to complete the configuration and smooth running. ... View more