topic Re: Splunk License Master and Heavy Forwarder communicate in Deployment Architecture

Splunk License Master and Heavy Forwarder communicate

AlesFrohlich — Thu, 18 May 2017 07:30:22 GMT

Hello,

does anyone know if there is any communication between License Master and Heavy Forwarder initiated by the License Master. I know that Heavy Forwarder initiate some communication with License Master to download license information. I also found that indexers are reporting every minute an amount if indexed data to License Master. However I have not found any official Splunk explanation what communications exist and how the components exactly talk together.

There is a simple reason for this question ... our firewall guys are complaining to open tcp/8089 initiated from License Master to Heavy Forwarders.

Thanks to anyone for an answer.

Best Regards,
Ales

Re: Splunk License Master and Heavy Forwarder communicate

dsctm3 — Fri, 19 May 2017 19:59:05 GMT

Not sure on the license front, but TCP/8089 is used for more than Licensing.

This includes deployment client, distributed management console etc. If you have more than just licensing on the host serving that function, you have clear justification to request that port being opened as splunk uses TCP/8089 for all of those features.

Re: Splunk License Master and Heavy Forwarder communicate

somesoni2 — Fri, 19 May 2017 21:02:36 GMT

AFAIK, The slaves report their license usage to License Master and there is no communication happens from LM to L slaves.

Re: Splunk License Master and Heavy Forwarder communicate

AlesFrohlich — Mon, 22 May 2017 06:42:24 GMT

Thank you for your replies. The server is only license master. So the one way communications should be enough.

Thanks a lot from help.

Regards,
Ales