topic Multisite Indexer Cluster Replication Port in Deployment Architecture

Multisite Indexer Cluster Replication Port

gcusello — Fri, 20 Oct 2023 08:58:43 GMT

Hi at all,

I have to configure a multisite Indexer Cluster and I have a dubt:

in the Splunk architectig course, the indicated Indexer Cluster replication port was 9100.

Then reading Multisite Indexer Cluster documentation the indicated port is 9887.

What's the correct one?

Can I use 9100 instead 9887 or 9100 is dedicated to other purposes?

Thank you for your support.

Ciao.

Giuseppe

Re: Multisite Indexer Cluster Replication Port

richgalloway — Fri, 20 Oct 2023 13:16:55 GMT

As I understand it, there is no default replication port. The cluster will use whatever is in the [replication_port://<port>] or [replication_port-ssl://<port>] stanza.

Re: Multisite Indexer Cluster Replication Port

inventsekar — Fri, 20 Oct 2023 13:51:36 GMT

For new Splunk learners reference, this should be done on server.conf file:

https://docs.splunk.com/Documentation/Splunk/9.1.1/admin/serverconf

All default ports listed:

https://docs.splunk.com/Documentation/Splunk/9.1.1/InheritedDeployment/Ports

Re: Multisite Indexer Cluster Replication Port

isoutamo — Fri, 20 Oct 2023 15:09:46 GMT

As @richgalloway said, there is no “default” ports, just examples. You could choose what ever you want.