https://community.splunk.com/t5/Reporting/Used-Forwarder-Ports/m-p/86630#M1951 <P>That is correct.</P> <P>8000 - Web interface<BR /><BR /> 8089 - Splunkd<BR /><BR /> 9997 - Receiving port for forwarded events</P> <P>You likely won't need to be able to access the Splunkd port from your forwarders unless you're setting up deployment client/servers. Similarly the web interface doesn't have to be accessible from the forwarders. The only port you need to be able to access for that purpose is 9997.</P> Wed, 05 Oct 2011 07:07:55 GMT Ayn 2011-10-05T07:07:55Z https://community.splunk.com/t5/Reporting/Used-Forwarder-Ports/m-p/86629#M1950 <P>Hi</P> <P>I would like to install a forwarder behind a firewall.<BR /> It should be a normal forwarder not a lightweight forwarder to collect some data and forward that data to the indexer.</P> <P>If I'm right then the only port to open is TCP 9997.</P> <P>The other ports splunk uses are <BR /> web TCP 8000 and management TCP 8089</P> <P>Is this right or are there other ports too which splunk use ?</P> <P>Thanks <BR /> Robert</P> Wed, 05 Oct 2011 05:43:38 GMT https://community.splunk.com/t5/Reporting/Used-Forwarder-Ports/m-p/86629#M1950 RobertRi 2011-10-05T05:43:38Z https://community.splunk.com/t5/Reporting/Used-Forwarder-Ports/m-p/86630#M1951 <P>That is correct.</P> <P>8000 - Web interface<BR /><BR /> 8089 - Splunkd<BR /><BR /> 9997 - Receiving port for forwarded events</P> <P>You likely won't need to be able to access the Splunkd port from your forwarders unless you're setting up deployment client/servers. Similarly the web interface doesn't have to be accessible from the forwarders. The only port you need to be able to access for that purpose is 9997.</P> Wed, 05 Oct 2011 07:07:55 GMT https://community.splunk.com/t5/Reporting/Used-Forwarder-Ports/m-p/86630#M1951 Ayn 2011-10-05T07:07:55Z