topic Re: 9998 port to open in Getting Data In

9998 port to open

vikram_m — Mon, 03 Apr 2017 14:06:03 GMT

Port on the server and the network seems open for 9998 port for indexers to receive data but only 1 out of the 3 indexer is able to get data from forwarder service.

Is there anything on the console I need to ensure that 9998 port is open and Splunk can receive data from forwarders.

Re: 9998 port to open

woodcock — Mon, 03 Apr 2017 14:21:54 GMT

Must not be blocked by firewall on either end. Must be route from forwarder to Indexer. ACL must be OK. Forwarder's outputs.conf must have all 3 Indexers defined. All Indexers must have the same inputs.conf settings. Try splunk list inputstatus on each Indexer and compare.

Re: 9998 port to open

vikram_m — Tue, 04 Apr 2017 10:23:48 GMT

Thanks Woodcock

It seems you have a solution for me....I fired the command on all the 3 indexers we have and only one server showed below result.

tcp_cooked:listenerports :
9997

Else for this other 2 indexer in cluster show

tcp_cooked:listenerports :
9997

Now please suggest where is the setting from where I can get the 9998 port opened.

Thanks a lot for the initial finding help.

Thanks.
Vikram.

Re: 9998 port to open

woodcock — Tue, 04 Apr 2017 13:36:14 GMT

Yes you can add another listening port by either:
a) Using the GUI by going to Settings -> Data Inputs -> TCP -> New
b) Using the command-line command, ./splunk enable listen 9998 -auth admin:change me # Needs option for SSL
c) editing the inputs.conf file and adding a new stanza like this:

[splunktcp-ssl:9998]
compressed = true

See this documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutforwardingandreceivingdata

Regarding SSL encryption, you need to decide whether you want to use your own certificates or the ones supplied by Splunk. I suggest you read this:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/UseSSLtoencryptandauthenticatedatafromforwarders