Getting Data In

Setting up Splunk receiver through TCP/IP

Caio_Santos
Path Finder

Hey everybody,

I'm going through some problems trying to set my receiver splunk instance. I performed exactely the ways which is described on the documantation, although Im still getting one error when I attempt to save my new date TCP input.

That's the error:

Encountered the following error while trying to save: In handler 'raw': TCP port 333 is not available.

As I said before, I followed each step on the docs, but for sure I'm missing something. I am sorry if I am being an ignorant, but I'm just starting with splunk.

Thank you in advance.

Tags (1)
2 Solutions

southeringtonp
Motivator

Is something else running on port 333 already? At the command line, try running netstat -an to check.

Also, if you are running Splunk as a non-root user, Splunk will not be able to bind to ports below 1024, as those ports are considered privileged.

Do you have the same problem with other port numbers, especially with port numbers above 1024?

View solution in original post

Genti
Splunk Employee
Splunk Employee

Caio, is this on a unix box?
If so, there might be a permission issue as only root can open ports under 1024.
You can try listening to tcp on a higher port, say 9001. Let us know if you get similar errors then.
Cheers,
.gz

View solution in original post

Genti
Splunk Employee
Splunk Employee

Caio, is this on a unix box?
If so, there might be a permission issue as only root can open ports under 1024.
You can try listening to tcp on a higher port, say 9001. Let us know if you get similar errors then.
Cheers,
.gz

southeringtonp
Motivator

Is something else running on port 333 already? At the command line, try running netstat -an to check.

Also, if you are running Splunk as a non-root user, Splunk will not be able to bind to ports below 1024, as those ports are considered privileged.

Do you have the same problem with other port numbers, especially with port numbers above 1024?

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...