Security

Issue getting data in

ThomasLeroy
Explorer

Hello,

I have an issue when i try to get data in Splunk 6.2.1
I created /opt/splunk/system/local/inputs.conf but i receive no data.

[udp://@ip:514]
connection_host = ip
index = firewall

whereas when iadd data from the webUI, there are no issue.
I put only udp://514, i know this is not a connectivity problem.
None of my modifications in the config file are apply when i restart Splunk

I really need help on this.

Thank you

Tags (2)
0 Karma

Patient
Path Finder

Hello,

To add an input by directly editing inputs.conf, add a stanza for the input. You can add the stanza to the inputs.conf file in $SPLUNK_HOME/etc/system/local/, or in your own custom application directory (in $SPLUNK_HOME/etc/apps//local). If you have not worked with Splunk's configuration files before, read "About configuration files" before you begin.

You configure the data input by adding attribute/value pairs to its stanza. You can set multiple attributes in an input stanza. If you do not specify a value for an attribute, Splunk Enterprise uses the default value that's preset in $SPLUNK_HOME/etc/system/default/inputs.conf.

Here's a simple example of adding a network input. This configuration directs Splunk Enterprise to listen on TCP port 9995 for raw data from any remote server. The host of the data is set as the DNS name of the remote server. All data will also be assigned the source type "log4j" and the source "tcp:9995".

[tcp://:9995]
connection_host = dns
sourcetype = log4j
source = tcp:9995

For more information, visit:
http://docs.splunk.com/Documentation/Splunk/6.1.5/Indexer/Aboutindexesandindexers

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi ThomasLeroy,

adding an IP to this stanza, will not bind UDP input to this IP, but only accept traffic from this IP.
See the docs for more details on this http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/inputsconf

[udp://<remote server>:<port>]
* If <remote server> is specified, the specified port will only accept data from that server.
* If <remote server> is empty - [udp://<port>] - the port will accept data sent from any server.

cheers, MuS

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...