topic Universal Forwarder port requirements to forward syslog traffic in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-port-requirements-to-forward-syslog-traffic/m-p/95893#M19962 <P>I need to configure Firewalls for the required ports in order to forward syslog traffic from my syslog server that I'm installing forwarder on to Splunk. Does the forwarder use the defaul syslog "514/UDP" port?<BR /> Thanks!</P> Wed, 11 Jul 2012 16:07:41 GMT ashafiee 2012-07-11T16:07:41Z Universal Forwarder port requirements to forward syslog traffic https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-port-requirements-to-forward-syslog-traffic/m-p/95893#M19962 <P>I need to configure Firewalls for the required ports in order to forward syslog traffic from my syslog server that I'm installing forwarder on to Splunk. Does the forwarder use the defaul syslog "514/UDP" port?<BR /> Thanks!</P> Wed, 11 Jul 2012 16:07:41 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-port-requirements-to-forward-syslog-traffic/m-p/95893#M19962 ashafiee 2012-07-11T16:07:41Z Re: Universal Forwarder port requirements to forward syslog traffic https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-port-requirements-to-forward-syslog-traffic/m-p/95894#M19963 <P>A forwarder is able to listen on udp/514, it's just up to you to define the network ports on which you'd like your forwarder to listen.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports">http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports</A></P> Wed, 11 Jul 2012 16:25:31 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-port-requirements-to-forward-syslog-traffic/m-p/95894#M19963 jbsplunk 2012-07-11T16:25:31Z Re: Universal Forwarder port requirements to forward syslog traffic https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-port-requirements-to-forward-syslog-traffic/m-p/95895#M19964 <P>By default though, traffic from a Splunk forwarder to another Splunk instance (indexer or intermediate forwarder) commonly uses TCP/9997 as port.</P> Wed, 11 Jul 2012 17:26:06 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-port-requirements-to-forward-syslog-traffic/m-p/95895#M19964 Ayn 2012-07-11T17:26:06Z