Network ports With a Splunk Enterprise license, you can enable input on any TCP or UDP port. Splunk consumes any data sent on these ports. TCP is the protocol underlying Splunk's data distribution, which is the recommended method for sending data from any remote machine to your Splunk server. Important: In version 3.3.3 of Splunk, default syslog processing via UDP does not correctly handle line-breaks. To work around this issue, add _linebreaker = _linebreaker to the UDP stanza in $SPLUNK_HOME/etc/system/local/inputs.conf. This issue was resolved in 3.3.4.