Getting Data In

Heavy forwarder isn't forwarding data from UDP port to indexer

project9433
Engager

Hello team, I have a HF in place and it is supposed to listen to a UDP port and forward the data to the indexer. Its confirm the netstat shows UDP port open and also network Team confirms for the port receiving data. But the splunk below configurations are not successful:

/opt/splunk/etc/system/local/inputs.conf
[udp://1049]
index=abc
sourcetype=efg
disabled = 0

outputs.conf
having indexer conf

splunkd.log shows only one entry for port as
INFO TcpInputProc - Closing raw IPv4 port 1049

Please help on this to make the instance listen to UDP port.

0 Karma

mayurr98
Super Champion

You can configure Splunk to listen on a > 1024 port and use Linux's iptables to do port redirection.

For example, configure in inputs.conf: [udp:1049]

And put into your iptables config:

iptables -t nat -A PREROUTING -p udp --dport 514 -j REDIRECT --to-port 1049

Also check conncetion between forwarder and receiver
Refer this link:
https://docs.splunk.com/Documentation/Splunk/7.0.1/Forwarding/Receiverconnection

you need to enable forwarder receiving port on indexer :
refer this link to do the same:
http://docs.splunk.com/Documentation/Forwarder/7.0.1/Forwarder/Enableareceiver

Let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...