https://community.splunk.com/t5/Splunk-Search/Splunk-Data-flow-Diagram/m-p/78483#M181641 <P>I don't know that you need a diagram. There isn't that much. Forwarders send to the splunktcp port on the destination (which may be another forwarder, but that is dependent on your designed architecture), which is arbitrary, but conventionally we use 9997. And search heads talk to the splunkd port, which is by default on port 8089.</P> <P>That's it for data flow. If you need more information, you should probably look at the appropriate sections of the documentation, <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview</A> and <A href="http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutindexesandindexers">http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutindexesandindexers</A> are probably most relevant.</P> Thu, 28 Mar 2013 21:23:03 GMT gkanapathy 2013-03-28T21:23:03Z https://community.splunk.com/t5/Splunk-Search/Splunk-Data-flow-Diagram/m-p/78482#M181640 <P>Can some one guide us or provoide us with the splunk data flow diagram </P> <P>with all the port number services etc </P> Thu, 28 Mar 2013 19:47:06 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Data-flow-Diagram/m-p/78482#M181640 allamiro 2013-03-28T19:47:06Z https://community.splunk.com/t5/Splunk-Search/Splunk-Data-flow-Diagram/m-p/78483#M181641 <P>I don't know that you need a diagram. There isn't that much. Forwarders send to the splunktcp port on the destination (which may be another forwarder, but that is dependent on your designed architecture), which is arbitrary, but conventionally we use 9997. And search heads talk to the splunkd port, which is by default on port 8089.</P> <P>That's it for data flow. If you need more information, you should probably look at the appropriate sections of the documentation, <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview">http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview</A> and <A href="http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutindexesandindexers">http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutindexesandindexers</A> are probably most relevant.</P> Thu, 28 Mar 2013 21:23:03 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Data-flow-Diagram/m-p/78483#M181641 gkanapathy 2013-03-28T21:23:03Z