topic Re: Error message on Splunk in Splunk Enterprise

Error message on Splunk

hordoffa1970 — Wed, 18 Feb 2026 03:04:14 GMT

Encountered the following error while trying to save: Failed to create. Configuration for port 9997 already exists. I am getting this message on Splunk when I try to configure and save the listening port

Re: Error message on Splunk

livehybrid — Wed, 18 Feb 2026 11:30:15 GMT

Hi @hordoffa1970

As the error suggests, it looks like something is already listening on port 9997.

What exactly is it you are trying to do? Do you already have an inputs.conf configured to receive data (or is something else on your system using port 9997)?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Error message on Splunk

kknairr — Thu, 19 Feb 2026 02:32:47 GMT

@hordoffa1970 The error message “Failed to create. Configuration for port 9997 already exists” means the receiving port you’re trying to configure is already set up somewhere in your Splunk configuration. Port 9997 is the default receiving port for Splunk indexers, so if it’s already enabled, trying to add it again will trigger this message.

You can check existing receiving configuration In Splunk Web by navigating to: 
Settings → Forwarding and Receiving → Configure Receiving

You should see port 9997 already listed. If 9997 is already active, you don’t need to add it again. Just confirm it’s listening.

> Giving Karma & Marking the answer helps others find solutions faster!