Hi,
I created an app with an inputs.conf file to collect syslog data (udp 514) from a particular host and send it to a sourcetype and index. I see the data coming in when I run a Wireshark but I dont see the data when I run a search query on the index I specified. Any clues?
I am collecting syslogs on a heavy forwarder and then forwarding that off to Splunk Cloud indexers.
Inputs.conf
[udp://ip address here:514]
connection_host = dns
sourcetype = slack
index = slack
disabled = false
outputs.conf (is contained on a different app that outputs all )
[tcpout]
defaultGroup = splunkcloud
forwardedindex.2.whitelist = (_audit|_introspection|_internal)
[tcpout:splunkcloud]
server = splunkcloud addresses here :9997
compressed = false
Are you collecting the syslog on the Splunk indexer, or forwarding it from the box with a syslog input to another Splunk box? Please include you inputs and outputs conf files.