Getting Data In

Why are new UDP data inputs for multiple hosts initially disabled after creation?

xxyz
Explorer

Creating new UDP Data Inputs for received syslog data from specific hosts to go to a specific Index. After creating the data input with multiple hosts (comma delimited) the status is initially disabled. I have no problem enabling afterwards, but wondering if multiple hosts aren't allowed and that is why it is disabled or is it just a precaution?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yeah, inputs.conf

0 Karma

xxyz
Explorer

so i added them all in. no problems. they show up in the gui just fine. however...

when i set a stanza to collect all syslog traffic and direct it to index 'syslog', it doesn't show in the gui. so will this work even though it's not showing?

[udp:514]
index = syslog
sourcetype = syslog
connection_host = ip

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Did you bump Splunk after making the change in the .conf file? Either by restarting or by hitting this URL:

http://your_host:8000/en-US/debug/refresh?entity=admin/conf-inputs
0 Karma

xxyz
Explorer

interesting. normally configurations adding in the gui update conf files under local, but these additions do not.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

All UI settings must appear under local directories, else they would be lost on an upgrade of Splunk.
Make sure you've not just checked the wrong app and keep system/local in mind.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How are you creating the inputs?

0 Karma

xxyz
Explorer

through the gui: settings > data inputs > > udp > new

is there a conf to do this?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk Life | Splunk is Officially Part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...