Hello Sumanta!

Your config looks good.

The log about the statistics show that there are no incoming messages on 514 UDP and nothing is written to the files defined in the d_splunk destination.

I think you could try to narrow down the scope of the problem with the following ideas.

Try to send a message locally to 514 with:

  echo "foo bar" | nc -u -w0 localhost 514

If it does not work, I would suggest to change the receiving port of the network() source to something larger, like port(12345), and trying again with the following, just to see if the problem only occurs for the 514 port:

  echo "foo bar" | nc -u -w0 localhost 12345

You should see these kind of logs:

[2024-01-15T15:58:46.037255] Incoming log entry; input='foo bar\x0a', msg='0x7f9bb0003020', rcptid='297'

...

[2024-01-15T15:58:46.037655] Initializing destination file writer; template='......', filename='......', symlink_as='(null)'

...

[2024-01-15T15:58:46.037872] Outgoing message; message='bar'

My hunch is that this probably has something to do with SELinux, but unfortunately my knowledge of it is very limited.

Regards,

Attila