HF multiple UDP port listening | Best practices

[GaetanVP]

Hello Splunkers,

I have a Splunk HF that will receive multiple logs coming from different machines, all sending via UDP.
I am wondering it I need to configures the external sources to send the logs via UDP but with different port (on port for each sources), or if I can simply tell all my sources to send over UDP port 514 for instance.

I am wondering if the UDP port 514 could become a "network bottleneck" because of too many logs coming from multiple sources on the same port. 

Thanks for your help,

GaetanVP

[gcusello · Accepted solution]

Hi @GaetanVP,

if your data sources permit to configure a different port for each one, it's easier for you because you don't need to manually modify conf files.

But anyway you could also use the same 514 port for all logs and separate data sources based on the ip address, but you need to manually modify conf files because Splunk doesn't permits (via GUI) to add two network data sources using the same port, but it's possible via conf file.

Ciao.

Giuseppe

[TheSteveBennett]

If I have already configured UDP 514 as an input, where is that input.conf file located so I can modify if for other logs?

[gcusello]

Hi @TheSteveBennett ,

don't attach a new question to an existing 8and closed) one because it's difficoult to have an answer, open a new question!

Anyway, you have to serch in many inputs.conf files that you have in the Splunk Receiver (usually an Heavy Forwarder).

If you want to use te same port for same logs (same index and sourcetype, you don't need to no anything,

Remember that if you want to use a different port, you can do it by GUI, if instead you want to use the same port for a different sourcetype, you have to do it modifying the inputs.conf file and adding also an IP address of the receiver.

Ciao.

Giuseppe

[GaetanVP]

Hello @gcusello,

Thanks a lot for your answer, that makes total sense.

Regards,
GaetanVP