topic Re: What are the ports that I need to open? in Getting Data In

What are the ports that I need to open?

antoaravinth — Wed, 04 Nov 2020 21:11:30 GMT

Hi, for Splunk to work properly, what are the ports that I need to open?

Can anyone specify the inbound ports and outbound ports?

Re: What are the ports that I need to open?

mikelanghorst — Mon, 17 Sep 2012 15:57:30 GMT

defaults are
9997 for forwarders to the Splunk indexer.
8000 for clients to the Splunk Search page
8089 for splunkd (also used by deployment server).

All of these can be changed if desired.

Re: What are the ports that I need to open?

andyfry_nec — Thu, 18 Oct 2012 22:14:55 GMT

Hi,

I have similar questions, but I need a bit more detail about direction.

Is the splunk forwarder port 9997 tcp/udp from agent to indexer ?
Is the splunk management port 8089 tcp only and from indexer/deployment server to agent or bidirectional?

Cheers

Andy

Re: What are the ports that I need to open?

mikelanghorst — Thu, 18 Oct 2012 22:23:47 GMT

8089 for the deployment server is only needed from the client to the deployment server. Client being indexer, UF, etc.
9997 from the forwarder to the indexer. No connection is needed back from the indexers.
8089 is also used from a Search Head to your indexers. Again only single direction.

Re: What are the ports that I need to open?

hokie1999 — Mon, 25 Feb 2013 15:30:23 GMT

On my forwarders, I see bi-directional data flowing on port 9997 between the forwarders and the indexers (using tcpdump src port 9997 and tcpdump dst port 9997)

Re: What are the ports that I need to open?

hokie1999 — Mon, 25 Feb 2013 15:35:38 GMT

BTW, on my forwarders, using tcpdump, I never see port 8089 used. I do see the forwarder listening on port 8089, just no data flowing. Seems odd.

Re: What are the ports that I need to open?

mikelanghorst — Mon, 25 Feb 2013 15:48:46 GMT

The communication on port 8089 will only be if you've setup the deployment server.

Re: What are the ports that I need to open?

mikelanghorst — Mon, 25 Feb 2013 15:52:19 GMT

Splunk will only use src port 9997 as replies (src ports are usually higher numbers). I suspect you're reading this data incorrectly. Unless you've set your indexers to output data to the forwarders, there's no reason for the indexers to initiate communication. If they were, the src ports would be higher random numbered ports.

Re: What are the ports that I need to open?

yannK — Mon, 25 Feb 2013 15:59:23 GMT

you can add :
port 8089 for the license-master (from license-slave to license-master)
port XXXX for the replication cluster master, and slaves.

and any other ports open to monitor tcp/udp.

Re: What are the ports that I need to open?

hokie1999 — Mon, 25 Feb 2013 16:07:50 GMT

From splunk indexer 1:

tcpdump src port 9997

16:03:15.882512 IP ddcsplunkindex01.ddc.verizon.com.palace-6 > 152.190.138.xxx.40612: Flags [P.], seq 114:171, ack 3058, win 6767, options [nop,nop,TS val 511776904 ecr 342512613], length 57

Re: What are the ports that I need to open?

bandit — Wed, 15 Jan 2014 21:19:41 GMT

This is a diagram of Splunk components and network ports that are commonly used in a Splunk Enterprise environment. Firewall rules often need to be updated to allow communication on ports 8000, 8089, 9997, 514 and others.

Source files available here: http://downloads.jordan2000.com/splunk/

Updated version

Original version

Re: What are the ports that I need to open?

yannK — Wed, 15 Jan 2014 22:07:52 GMT

clap clap clap.

Re: What are the ports that I need to open?

Steve_G_ — Mon, 10 Nov 2014 19:43:53 GMT

9997 is not a default; just a convention. You need to set it explicitly on the receiving instance (indexer).

Re: What are the ports that I need to open?

nitinsheenu — Tue, 25 Nov 2014 01:15:13 GMT

It seems many are confused about port required from UFs to a HF. Which is 9997 too i.e.

UFs ---9997---> HF --- 9997---> Indexers
UFs, Indexers, SHs ---8089 ---> DS

Many uses HF & DS as same server.

Re: What are the ports that I need to open?

steven_swor — Tue, 03 Feb 2015 02:14:37 GMT

Wow. Nicely done. This is so hard to find in the official documentation.

I would also suggest adding flows on port 9997 from the search heads, deployment server, license server, and cluster master to the indexers, with a footnote that this is an optional flow used for forwarding Splunk's internal indexes (a recommended best practice).

Re: What are the ports that I need to open?

renems — Thu, 26 Feb 2015 09:34:02 GMT

Since splunk 6.2 also port 8191 is used for the kvstore.

Re: What are the ports that I need to open?

tross33 — Mon, 09 Mar 2015 14:26:25 GMT

Kudos. This is very helpful Rob.

Re: What are the ports that I need to open?

bandit — Tue, 24 Mar 2015 20:36:02 GMT

I should get around to updating soon with the feedback I've received.

Re: What are the ports that I need to open?

hsesterhenn_spl — Mon, 20 Apr 2015 16:07:00 GMT

And mark which connections are using SSL bei default (which have to be switched on manually...)

Great picture!

Thank you very much...

Holger

Re: What are the ports that I need to open?

koshyk — Tue, 02 Jun 2015 15:03:31 GMT

@rob_jordan : Your picture speaks 100000k words 🙂 very helpful