Security

how to change SplunkD port since it has utilised my port 514 for syslog purpose.

tailesley
New Member

HI,

I would like to make enquiry about the setting of my splunk. I would like to poll syslog data through the UDP port 514, however i check on the service this has been utilised by SplunkD. Anyway to change the splunkD port since my application only can use port 514 to poll syslog data. Need your advice urgently. Thank you.

Tags (2)
0 Karma

thinkingphones
New Member

You can setup a port-forward using iptables, for example:

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

Redirect syslog to port above 1024

-A PREROUTING -p udp -m udp --dport 514 -j REDIRECT --to-ports 5514
COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:FIREWALL - [0:0]
-A INPUT -j FIREWALL
-A FORWARD -j FIREWALL

-A FIREWALL -i lo -j ACCEPT

Allow return traffic

-A FIREWALL -m state --state ESTABLISHED,RELATED -j ACCEPT

Allow redirected syslog messages

-A FIREWALL -p udp -m udp --dport 5514 -j ACCEPT

0 Karma

David
Splunk Employee
Splunk Employee

I would hazard a guess that if you looked at your inputs in the manager ( http://YourServer:8000/en-US/manager/RTB/data/inputs ) you would see that Splunk is configured to listen on port 514, so that it can listen to syslog data itself. You can change that there -- keep in mind though, that you may lose the data that Splunk would normally be getting through syslog, so you should find another way of getting that data (either change the sending port, have your application toss it in a log file, or etc.)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...