topic Re: Network prerequisites Splunk Universal Forwarder in Deployment Architecture

Network prerequisites Splunk Universal Forwarder

michaelteck — Mon, 18 Mar 2024 10:34:27 GMT

Hello everyone,

In my splunk journey, I've to make a documentation for the installation of the Universal Forwarder.
Ours Forwarders will be install VMs who are on a private network so we need some configuration on the network to let the Universal Forwarder to send data to the indexers splunk.
Ours indexers are install on another private network, we created a rule on the network to receive data on the port 9997 of the Splunk server.
I'm looking for network prerequisites before the installation of the fowarder.
What rules we have to create on the Forwarder's network ?
What port we have to open on the Forwarder's network ?
Do we need to create a specific flow for the Forwarder to send data to the indexers?
What protocol we have to setup on the Forwarder's network?

Thank for all who read me,

Re: Network prerequisites Splunk Universal Forwarder

isoutamo — Mon, 18 Mar 2024 11:16:33 GMT

here is network diagram which describes which ports and what directions should/must be open. https://www.aplura.com/assets/pdf/splunk_common_ports.pdf

r. Ismo

Re: Network prerequisites Splunk Universal Forwarder

kiran_panchavat — Mon, 18 Mar 2024 18:09:37 GMT

@michaelteck

The Splunk Documentation has a page that discusses which ports need to be opened, and has diagrams for both standalone and distributed deployments: https://docs.splunk.com/Documentation/Splunk/latest/InheritedDeployment/Ports

https://kinneygroup.com/blog/splunk-default-ports/

If my comment helps, please give it a thumbs up!