Splunk Operational Intelligence Cookbook - Third Edition

How to do it...

Follow these steps to configure Splunk to receive network UDP data:

1. Log in to your Splunk server.
2. From the menu in the top right-hand corner, click on the Settings menu and then click on the Add Data link.
3. If you are prompted to take a quick tour, click on Skip.
4. In the How do you want to add data section, click on Monitor.

5. Click on the TCP / UDP section:
   
6. Ensure the UDP option is selected and in the Port section, enter 514. On Unix/Linux, Splunk must be running as root to access privileged ports such as 514. An alternative would be to specify a higher port, such as port 1514, or route data from 514 to another port using ...