Splunk® Light (Legacy)

Getting Started Manual

Acrobat logo Download manual as PDF


On October 22, 2021, Splunk Light will reach its end of life. After this date, Splunk will no longer maintain or develop this product.
Acrobat logo Download topic as PDF

Monitor network ports using Splunk Light

You can monitor TCP or UDP ports to add data from the syslog service on one or more machines.

Select the network source

1. In the Add Data view, click Monitor.

2. Select TCP/UDP to view the configuration options for network ports.

3. Select either TCP or UDP.

4. Type in the Port number.

For example, the standard port for TCP is 9997 and for UDP is 514.

5. (Optional) Next to Source name override, type in a custom source name using the format host:port.

6. (Optional) Next to Only accept connection from, type in the name, IP address, or fully qualified domain name for each host. You can use wildcards to specify more than one host. This setting restricts the data input to specific machines or devices.

7. Click Next to continue.

Specify input settings

Use the Input Settings to modify the source type, host, and index assignments for the incoming network data.

1. Select the Source type from the list of predefined source types or type it in manually.

2. (Optional) Assign the Host field value.

  • Select IP for IP addresses.
  • Select DNS for domain name system.
  • Select Custom to type in a host name.

3. (Optional) Select a different Index to store the data.

You can Create a new index and refresh the list of indexes. By default all data saves to the default main index.

4. Click Review to continue.

Review and Save

1. Review the summary of your data input.

2. (Optional) Go back to make changes.

3. Click Submit to complete the add data process.

Last modified on 05 April, 2016
PREVIOUS
Monitor files and directories using Splunk Light
  NEXT
Use HTTP Event Collector in Splunk Light

This documentation applies to the following versions of Splunk® Light (Legacy): 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters