topic Re: New ports open in Splunk 6, how are they utilized? in Knowledge Management

New ports open in Splunk 6, how are they utilized?

pkhalsa — Thu, 11 Jun 2015 15:07:50 GMT

At the "About upgrading to 6.2 - READ THIS FIRST" page, it states:
"This opens two network ports by default on the local machine: 8191 (for KV Store) and 8065 (for Appserver.) "

I want to upgrade my Splunk 5 search head to Splunk 6 today and upgrade all my indexers next week. In the meantime, I wanted to know if the indexers and search head will be communicating on these new ports? I assume so, but this statement isn't so explicit. When it says the ports are opened "on the local machine," it's not clear who the local machine will be communicating with when the new ports are opened.
Thanks.

Re: New ports open in Splunk 6, how are they utilized?

malmoore — Thu, 11 Jun 2015 16:28:30 GMT

The new network ports for Splunk Enterprise 6.2 are open for connections to the local instance. This means that other instances (such as search head cluster members, indexer cluster members, etc.) that use App Key Value Store (port 8191) and Appserver (8065) use these ports to handle those specific operations. If you block those ports, that communication can't happen.

Re: New ports open in Splunk 6, how are they utilized?

pkhalsa — Thu, 11 Jun 2015 16:40:20 GMT

Thanks. Will App Key Value Store and Appserver be turned on automatically when I upgrade? Are they essential for Splunk 6 to operate? Otherwise I'm not sure I necessarily need to open up those ports.

Re: New ports open in Splunk 6, how are they utilized?

malmoore — Thu, 11 Jun 2015 21:34:13 GMT

Yes, both will be turned on when you upgrade. You should determine whether or not you need to use both features before disabling them. A number of apps use App Key Value a Store, for example.

Re: New ports open in Splunk 6, how are they utilized?

Jrubalcaba — Mon, 12 Sep 2016 16:10:13 GMT

Are these ports inbound or outbound?

Re: New ports open in Splunk 6, how are they utilized?

malmoore — Tue, 13 Sep 2016 20:24:26 GMT

They are inbound, meaning that the Splunk process listens for connections from other hosts on these ports.