topic Re: Required network openings for a distributed Splunk setup in Deployment Architecture

Required network openings for a distributed Splunk setup

mart10 — Mon, 12 Oct 2020 04:37:41 GMT

I apologize if the title isn't very descriptive of the question I have, was not sure how to best frame it.

For a setup with numerous splunkforwarders forwarding to two indexing servers, and getting inputs/outputs from a deployment server, how is the network flow?

splunkforwarder -> splunk-index1/2 - is this forwarder-initiated?
splunk-master (deployment+cluster master) -> splunkforwarder - master or forwarder initiated for deployment of config/splunkd restarts?

I believe I found some information on this at some point, but that was for an older version and possibly outdated.

Re: Required network openings for a distributed Splunk setup

inventsekar — Mon, 12 Oct 2020 05:07:14 GMT

Hi @mart10

splunk-master (deployment+cluster master) -> splunkforwarder - master or forwarder initiated for deployment of config/splunkd restarts? ///

on Deployment server, when you make changes (to inputs.conf, etc), the changes will be sent to universal forwarders - In some cases, it deploys apps automatically. In other cases, you need to manually initiate the deployment.

https://docs.splunk.com/Documentation/Splunk/8.0.6/Updating/Updateconfigurations

The phone home interval (that is, how frequently each client checks in with the deployment server for updates)

https://docs.splunk.com/Documentation/Splunk/8.0.6/Updating/Calculatedeploymentserverperformance

phoneHomeIntervalInSecs = <number in seconds>
* Determines how frequently, in seconds, this deployment client should
  check for new content.
* Fractional seconds are allowed.
* Default: 60.
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Deploymentclientconf

Re: Required network openings for a distributed Splunk setup

isoutamo — Mon, 12 Oct 2020 05:41:02 GMT

Hi
here is diagram how nodes are connected together and which node is active on which connection.
https://docs.splunk.com/Documentation/Splunk/8.0.6/InheritedDeployment/Ports
r. Ismo

Re: Required network openings for a distributed Splunk setup

mart10 — Mon, 12 Oct 2020 06:15:00 GMT

Thanks, just so I am sure I properly understand this:

splunkforwarder -> indexers # this is forwarder-polling/initiated on port 9997.
splunkforwarder -> deployment # this is also forwarder-polling/initiated, port 8089.
indexer/deployment/head -> license server # this is indexer/deployment/head-polling on port 8089.

So overall, splunkforwarders initiates every connection to their mothership. And splunk servers initiates connections to the license server.

Re: Required network openings for a distributed Splunk setup

isoutamo — Mon, 12 Oct 2020 08:11:49 GMT

Yes, those are correct.