Enable receiving port on Splunk server

-
Prerequisite: Make sure the port number which you are adding is open and allowed to receive data.

There are multiple ways to accomplish this, lets go one by one:
  • CLI: Simplest and easiest way to add a port is via command line interface, you just need to traverse to $SPLUNK_HOME/bin directory and using the splunk universal binary you can do that.
[splunk@ip bin]# ./splunk enable listen 9999
Splunk username: admin
Password:
Listening for Splunk data on TCP port 9999.

Above command will require your Splunk admin credentials for adding/enabling the mentioned port number. 

PS: If you want to disable it simply use disable instead of enable i.e. ./splunk disable listen 9999, basically what it does it adds a flag in your stanza and mark it as 1 < disabled = 1 >.

Basically under the hood what is does, it creates a stanza in your inputs.conf 

[splunktcp://9999]
connection_host = ip

  • Config file:  Another way to do it, is via manually editing the conf file i.e. inputs.conf
Open your inputs.conf and add below stanza at the bottom of the file, it will enable port number 9000 on your Splunk server. Make sure to restart your Splunk instance to notify Splunk about the changes which you have made.

[splunktcp://9000]
connection_host = ip
disabled = 0

  • GUI: Navigate to Settings => Data => Forwarding and Receiving and follow the step as depicted in below screen dumps.
Click on the hyperlink.
If you want to list all the enabled ports click on "Configure Receiving", and if you want to add a port click on "+Add New".
Enter the port number which you want to open then click on "Save".
Once done you will be brought to page which consists of all the open ports (from here as well you can enable/disable/delete a port entry).

Comments

Post a Comment

Popular posts from this blog

#3 Splunk sub(Commands) [eval, round, trim, stats, ceil, exact, floor, tostring]

-
Image
ROUND: Eval with round takes one or two numeric arguments, returning 'first value' rounded to the amount of decimal places specified in 'second value'.  By default it will remove all the decimals. Example: index=idx_messages sourcetype=linux_logs | eval new_rt= trim ( replace (response_time, "ms.", "")) | stats avg (new_rt) as Average | eval Average= round (Average) Remove all the decimal values. Example: | eval Average= round (Average,3) Rounded the value up-to 3 decimal places. Example: | eval Average= ceil (Average) Round the value up-to the next highest integer. Example: | eval Average= exact (Average) Give the output with maximum possible number of decimal values. Example: | eval Average= floor (Average) Round the value down to the nearest whole integer. Apart from this, there are other functions as well which are used by eval command, for instance pi (), sqrt () etc. TOSTRING: Hel
Read more

#6 Splunk sub(Commands) [fields, rename, replace, table, transaction]

-
FIELDS:  This command helps to keep or remove specified fields from the search results, below command will keep just three fields in your search result. Example: | fields request, rc, pt RENAME:  This command helps to rename field(s), below command will rename a field named as service to serviceType and RC as responseCode Example: | rename service AS serviceType, RC AS responseCode REPLACE:  This command helps to replace the values of fields with another value, below command will replace the values "fetchReport" and "viewReport" as "Report" in "serviceType' field. Example: | replace fetchReport with Report, viewReport with Report in serviceType TABLE: This command helps to format the results into tabular output. Example: | table request, rc, pt TRANSACTION:  This command helps to merge events into a single event based upon a common identifier, below command will create events based on two events i.e. it will fetch the txn-id w
Read more

#2 Splunk sub(Commands) [eval, trim, chart, showperc, stats, avg]

-
Image
TRIM: Basically it helps you to create more meaning full data from existing data i.e. it helps you to remove noise from the results. Example: index=idx_messages sourcetype=linux_logs | eval new_rt= trim (replace( response_time , "ms.", "")) In above example, response_time is an existing field which consists of some unwanted data like "ms." which we don't want. So, by using eval and trim we can remove that unwanted data. If you will notice, above search will create a new field called new_rt which contains our intended results i.e. without "ms." CHART: It basically results your finished data in a table format, further that data can be used to visualize via different mechanism. Example: index=idx_messages sourcetype=linux_logs | chart count by date client useother=f Honestly the example is not so good but I believe, you are able to reach to the crux of it, i.e. it will show you which client on which date made how ma
Read more