Refine your search:

I have a stream (udp 518) of syslog coming in from two different syslog servers. I thought that I would be able to specify in inputs.conf like so:

[udp://server1:518] sourcetype = syslog index = index1 connection_host = dns

[udp://server2:518] sourcetype = syslog index = index2 connection_host = dns

This is not working. If i comment out the second stanza, i can see syslog from server1 in index1, but nothing if both are uncommented. Any thoughts?

asked 20 Apr '12, 08:27

menkurau's gravatar image

menkurau
563
accept rate: 0%

edited 05 Jun '12, 10:32

sdaniels's gravatar image

sdaniels ♦
6.0k410


One Answer:

Don't specify the server and you'll get the data from both. [udp://518]

http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Add_a_network_input_using_inputs.conf

If <remote server=""> is empty - [udp://port] - the port will accept data sent from any server.

Then here to specify the sourcetype etc...

http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

link

answered 20 Apr '12, 11:26

sdaniels's gravatar image

sdaniels ♦
6.0k410
accept rate: 33%

edited 15 May '12, 15:26

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×677
×357
×294
×64

Asked: 20 Apr '12, 08:27

Seen: 1,228 times

Last updated: 29 Oct '12, 11:59

Copyright © 2005-2014 Splunk Inc. All rights reserved.