Archive
Highlighted

Splunk License Master and Heavy Forwarder communicate

Explorer

Hello,

does anyone know if there is any communication between License Master and Heavy Forwarder initiated by the License Master. I know that Heavy Forwarder initiate some communication with License Master to download license information. I also found that indexers are reporting every minute an amount if indexed data to License Master. However I have not found any official Splunk explanation what communications exist and how the components exactly talk together.

There is a simple reason for this question ... our firewall guys are complaining to open tcp/8089 initiated from License Master to Heavy Forwarders.

Thanks to anyone for an answer.

Best Regards,
Ales

Tags (1)
0 Karma
Highlighted

Re: Splunk License Master and Heavy Forwarder communicate

Path Finder

Not sure on the license front, but TCP/8089 is used for more than Licensing.

This includes deployment client, distributed management console etc. If you have more than just licensing on the host serving that function, you have clear justification to request that port being opened as splunk uses TCP/8089 for all of those features.

0 Karma
Highlighted

Re: Splunk License Master and Heavy Forwarder communicate

SplunkTrust
SplunkTrust

AFAIK, The slaves report their license usage to License Master and there is no communication happens from LM to L slaves.

0 Karma
Highlighted

Re: Splunk License Master and Heavy Forwarder communicate

Explorer

Thank you for your replies. The server is only license master. So the one way communications should be enough.

Thanks a lot from help.

Regards,
Ales

0 Karma