Description of the fields on the UDP data input configuration form.

Basic configuration

FieldDescription
Name Name of the new data input. This field is required.
Port The port for the MID Server.

Select a unique port from the array. The placeholder shows the range of ports from which to choose. Make sure that your organization’s security team opens the selected port.

This field is required.
MID The MID Server to which the logs are streamed.
Note:
  • You can select only MID Servers with log ingestion capability that support basic authentication. MID Servers that support mTLS are not listed.
  • The default maximum number of data inputs streaming logs to a single MID Server is 10. You can modify this number in the MID Server properties.
This field is required.
Application service The application service to which to bind the log data. This field is required.
Note: If no relevant application service exists, Create an application service and add CIs to it. Set the status of the new application service to Operational.

The fields in the following table show read-only information.

FieldDescription
Status Status of the data input.
Transport Protocol used to send the log data: UDP.
Sources count The number of log sources this data input has created.
Disabled since The time when the data input stopped or failed.
Last log time The time when the last log streamed in the data input.
Error message The streaming error.

This field is populated automatically. It displays only when a streaming error has occurred.

Advanced configuration

FieldDescriptionDefault value
Default timezone The default time zone of events. The system uses this default when the log does not specify a time zone. GMT
Sub sample drop ratio The ratio of events to drop. -1
Sub sample receive ratio The ratio of events to receive. -1
Rate limit Limitation on the number of events per second that the data input processes. -1
Max length in bytes The maximum length of log messages, in bytes. 32,766
Character encoding The character encoding for this data input. UTF-8
Drop if queue is full Option for selecting to discard logs if many processes are waiting in the queue to access the MID Server. false