Getting Data In

How do I identify UDP source on Splunk Indexer?

congoland
Engager

I'm fairly new to Splunk and inherited a messy environment. I'm trying to dissect log sources. I have 3 indexers that are receiving UDP logs and placing them in an index named "firewall" and am trying to figure out the UDP source so I can turn off logging.

When I search against the firewall index, I get multiple hosts but the source is always the same:
source = udp:11514

I checked the data inputs but don't see this UDP port defined with the specific firewall index name. What's the best way to determine where these UDP logs are coming from? It's possible that there's a rogue heavy forwarder that's sending them. Assume nothing's documented and best practices were not followed during configuration. Thank you.

0 Karma

rg33
Explorer

Are you using the CLI to show inputs? Try:

splunk cmd btool inputs list --debug

or this search processing language (SPL) for each forwarder:

| rest https://<forwarder-ip-address>:8089 /services/data/inputs/monitor

Maybe one of these will help track it down.

Or, if you want you can check the indexer listening ports, and run tcpdump to listen for incoming traffic. Here are some commands to help that:

netstat -aln |grep LISTEN
tcpdump -lnn port 11514

Hope this helps.

/rg

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...