how to change SplunkD port since it has utilised my port 514 for syslog purpose.

[tailesley]

HI,

I would like to make enquiry about the setting of my splunk. I would like to poll syslog data through the UDP port 514, however i check on the service this has been utilised by SplunkD. Anyway to change the splunkD port since my application only can use port 514 to poll syslog data. Need your advice urgently. Thank you.

[thinkingphones]

You can setup a port-forward using iptables, for example:

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

Redirect syslog to port above 1024

-A PREROUTING -p udp -m udp --dport 514 -j REDIRECT --to-ports 5514
COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:FIREWALL - [0:0]
-A INPUT -j FIREWALL
-A FORWARD -j FIREWALL

-A FIREWALL -i lo -j ACCEPT

Allow return traffic

-A FIREWALL -m state --state ESTABLISHED,RELATED -j ACCEPT

Allow redirected syslog messages

-A FIREWALL -p udp -m udp --dport 5514 -j ACCEPT

[David]

I would hazard a guess that if you looked at your inputs in the manager ( http://YourServer:8000/en-US/manager/RTB/data/inputs ) you would see that Splunk is configured to listen on port 514, so that it can listen to syslog data itself. You can change that there -- keep in mind though, that you may lose the data that Splunk would normally be getting through syslog, so you should find another way of getting that data (either change the sending port, have your application toss it in a log file, or etc.)