Troubleshooting¶

The input isn't responding
Run the following search to see why the input may not be working:¶

(index=_internal sourcetype=ftp_modular_input) OR (sourcetype=ftp)

The input doesn't seem to listen correctly on Windows (and you are having the input listen all interfaces such as "0.0.0.0")¶

The FTP server will attempt to listen on a port as denoted by your hostname. You should be able to connect to your host by it's hostname as opposed to the IP address. I recommend changing the input to listen on a particular port f this still doesn't work for you.

The input doesn't seem to listen correctly on Linux (on a port less than 1024 when running Splunk with a non-root user)¶

Linux/Unix does not allow non-root users to open a port less than 1024 by default. See https://www.geeksforgeeks.org/bind-port-number-less-1024-non-root-access/ for details on how to get around this issue.