Splunk Search

UDP Data Input receive but not indexed

nhurtaud
Explorer

Hi everyone,

I have some problem with data input on UDP port
I send from a log collector syslog messages.
These are bein received by the splunk host (tcpdump capture) but not indexed.
Data input is well configured (when i use netcat for send messages from log collector to data input, these messages are well-indexed).

I changed some parameters like queue (IndexQueue) to bypass transforms but it's not resolved this issue. Also, i try to change SHOULD_LINEMERGE to false.

If someone has an idea or has encountered this problem?

Thank you and have a nice day.
Nicolas HURTAUD

Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

Double check that splunk is listening to the port with netstat, disable any iptables.

If you are on linux and your syslog device uses ip spoofing, check this answer.
http://splunk-base.splunk.com/answers/12876/splunk-running-on-my-linux-server-is-only-showing-me-eve...

View solution in original post

0 Karma

mlf
Path Finder

I've hit this issue multiple times and still haven't found the cause. It seems to happen randomly and is source specific. For example, if my input is on udp:9999, and I have 10 hosts logging, one host's logs will stop getting indexed. Other hosts, even those coming from the same subnet as the missing host, will be fine. In my case, recycling the indexer will normally solve it for the short term.

I'm currently still running 4.3.6. Has anyone seen this in 5.x? Anyone have a clue as to the cause?

0 Karma

yannK
Splunk Employee
Splunk Employee

Double check that splunk is listening to the port with netstat, disable any iptables.

If you are on linux and your syslog device uses ip spoofing, check this answer.
http://splunk-base.splunk.com/answers/12876/splunk-running-on-my-linux-server-is-only-showing-me-eve...

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!