https://community.splunk.com/t5/Getting-Data-In/How-to-go-about-File-Monitoring-for-servers-in-cloud/m-p/610842#M105833 <P>Port 9997 is used for the Splunk-to-Splunk protocol. It doesn't specify where the data goes as that is controlled by the outputs.conf file.&nbsp; If the instance is a HF then it must have an outputs.conf file so all data it gets, regardless of the port, will be sent to your indexers.</P> Thu, 25 Aug 2022 16:02:51 GMT richgalloway 2022-08-25T16:02:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-go-about-File-Monitoring-for-servers-in-cloud/m-p/610838#M105831 <P>We have some servers that are deployed in AWS and we want to monitor some files that are on them.&nbsp; Typically, I'd go with the UF, but in this case our indexers only have private IPs.&nbsp; We do have some Heavy Forwarders that can be publicly addressed.&nbsp; We have only used that for HEC though.&nbsp; The Heavy Forwarders do have receiving set up on port 9997, but wouldn't that inde the data locally on the servers?</P> <P>&nbsp;</P> <P>Have any of you had a similar issue?</P> <P>&nbsp;</P> <P>We have a clustered on prem enviroment BTW.</P> Thu, 25 Aug 2022 16:20:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-go-about-File-Monitoring-for-servers-in-cloud/m-p/610838#M105831 tonysmith8583 2022-08-25T16:20:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-go-about-File-Monitoring-for-servers-in-cloud/m-p/610842#M105833 <P>Port 9997 is used for the Splunk-to-Splunk protocol. It doesn't specify where the data goes as that is controlled by the outputs.conf file.&nbsp; If the instance is a HF then it must have an outputs.conf file so all data it gets, regardless of the port, will be sent to your indexers.</P> Thu, 25 Aug 2022 16:02:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-go-about-File-Monitoring-for-servers-in-cloud/m-p/610842#M105833 richgalloway 2022-08-25T16:02:51Z