Getting Data In

New and started to input data

dxw350
Path Finder

So this is the first time I was trying to input the TCP data port to my monitoring. I am behind a NAT as it is with a FioS router in a home network environment. I wanted to monitor port 80 for web but that is not being allowed (I presume it has to do with the NAT). How do I monitor my computer as a test for traffic going/coming from the web on the Splunk monitoring tool? What settings/port numbers do I need as the input data?

Tags (1)
0 Karma

lguinn2
Legend

Splunk does not care what port you want to monitor - it can be anything. However, Splunk may be restricted because you are running Splunk from a non-privileged account (as you should).

On Linux for example, ports under 1024 are considered privileged; a non- root user cannot read these ports. This may be why you can't monitor port 80. There are ways to get around this.

I am also concerned when you say "monitor port 80 for traffic." Splunk's network inputs (TCP and UDP) read data from the port and index it; is this what you mean by "monitoring"? I feel like this is not what you want. You might also want to look at the free Splunk App for Stream

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...