#splunk #network #monitoring
Getting Data In
Get data from TCP and UDP ports
You can configure Splunk Enterprise to accept an input on any TCP or UDP port. Splunk Enterprise consumes any data that arrives on these ports. Use this method to capture data from network services such as syslog (default port is UDP 514). You can also set up the netcat service and bind it to a port.
For security, Splunk Cloud accepts connections only from forwarders with the correct Secure Sockets Layer (SSL) certificates. If you want to send data from a TCP or UDP source such as syslog, use the Splunk Universal Forwarder to listen to the source and forward the data to your Splunk Cloud deployment.
TCP is the network protocol that underlies the Splunk Enterprise data distribution scheme. It is the recommended protocol for sending data from any remote host to your Splunk Enterprise server. Splunk Enterprise can index remote data from syslog-ng or any other application that transmits via TCP.
Splunk Enterprise supports monitoring over UDP, but you should use TCP to send network data instead whenever possible. UDP is not desirable as a transport because, among other reasons, it does not guarantee delivery of network packets.
When you monitor TCP network ports, the user Splunk Enterprise runs as must have access to the port you want to monitor. On many Unix operating systems, by default, you must run Splunk Enterprise as the root user to listen directly on a port below 1024.
See Working with UDP connections on the Splunk Community Wiki for recommendations if you must send network data with UDP.
Confirm how your network device handles external monitoring before you use the network monitoring input
Before you begin monitoring the output of a network device with the Splunk Enterprise network monitor, confirm how the device interacts with external network monitors.
If you configure TCP logging on some network devices, such as a Cisco Adaptive Security Appliance (ASA), and the device cannot connect to the monitor, it might cause reduced performance or stop logging, or worse. By default, the Cisco ASA stops accepting incoming network connections when it encounters network congestion or connectivity problems.
Add a network input using Splunk Web
To add inputs from network ports using Splunk Web:
Go to the Add New page
You can get there through two routes.
By Splunk Settings:
2. Click Data Inputs.
4. Click New to add an input.
1. Click the Add Data link in Splunk Home.
2. Click Monitor to monitor a network port on the local machine, or Forward to receive network data from another machine.
Note: Forwarding a file requires additional setup.
3. If you selected Forward. choose or create the group of forwarders you want this input to apply to.
Specify the network input
1. In the left pane, click TCP / UDP to add an input.
2. Click the TCP or UDP button to choose between a TCP or UDP input.
3. In the Port field, enter a port number.
4. In the Source name override field, enter a new source name to override the default source value, if necessary.
Note: Consult Splunk Support before changing the “Source name override” value.
5. If this is a TCP input, specify whether this port should accept connections from all hosts or only one host in the Only accept connections from field. If you only want the input to accept connections from one host, enter the host name or IP address of the host. You can use wildcards to specify hosts.
6. Click Next to continue to the Input Settings page.
Specify input settings
The Input Settings page lets you specify source type, application context, default host value, and index. All of these parameters are optional.
1. Set the Source type . This is a default field that Splunk Enterprise adds to events and uses to determine processing characteristics, such as timestamps and event boundaries.
2. Set the Host name value. You have several choices:
- IP. Sets the input processor to rewrite the host with the IP address of the remote server.
- DNS. Sets the host to the DNS entry of the remote server.
- Custom. Sets the host to a user-defined label.
Learn more about setting the host value in “About hosts”.
Note:Host only sets the host field in the resulting events. It does not direct Splunk Enterprise to look on a specific host on your network.
3. Set the Index that Splunk Enterprise should send data to for this input. Leave the value as “default” unless you have defined multiple indexes to handle different types of events. In addition to indexes for user data, Splunk Enterprise has a number of utility indexes, which also appear in this dropdown box.
Review your choices
After specifying all your input settings, review your selections. Splunk Enterprise lists the options you selected, including the type of monitor, the source, the source type, the application context, and the index.
1. Review the settings.
2. If they are not what you want, click to go back to the previous step in the wizard. Otherwise, click Submit.
Splunk Enterprise then loads the “Success” page and begins indexing the specified network input.
Add a network input using the CLI
To access the Splunk Enterprise CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command.
If you get stuck, the CLI has help. Access the main CLI help by typing splunk help. Individual commands have their own help pages as well and can be accessed by typing splunk help command .
The following CLI commands are available for network input configuration: