topic Re: Splunk Heavy forwarder problem on port 9997 in Getting Data In

Splunk Heavy forwarder: How to fix the problem on port 9997?

MayurMangoli — Mon, 07 Aug 2023 19:14:55 GMT

HI,

i'm facing one of the issue on my heavy forwarder is not able to get the logs on 9997, where we have already configured the UF for port 9997 and receiving port 9997 on HF, but from the source to HF we telnet the HF on port 9997, for the first time it gets connected very next time it failed to connect.

due to this we have not receving UF logs on the

Re: Splunk Heavy forwarder problem on port 9997

gcusello — Sat, 05 Aug 2023 05:31:10 GMT

Hi @MayurMangoli,

did you permanently disabled the local firewall on the HF?

Ciao.

Giuseppe

Re: Splunk Heavy forwarder problem on port 9997

jotne — Sat, 05 Aug 2023 08:58:20 GMT

You are 100% sure your HF are listening on port 8089.

ss -pultan | grep LISTEN

should result in some like this:

tcp LISTEN 0 128 0.0.0.0:8089 0.0.0.0:* users:(("splunkd",pid=3870899,fd=4))