What Ports can I use for UF

[pfabrizi]

We are in the middle of deploying our UF to windows servers and we are running into port conflicts with other applications.
First we ran into a conflict with 8089 and now 8090. Can I change our port to something like 80899?

Thanks!

[DUThibault]

I don't see why you could not change the port settings. On the server, Settings: (System) Server settings: General settings lets you choose the management port (normally 8089) as well as the others. I'm not sure if changing this will automatically adjust the forwarder settings or if you'll have to edit the latter manually ( /opt/splunkforwarder/etc/system/local/outputs.conf).

[ArmbrusterC]

You can define in your outputs.conf file which port you want to use. After you do this you will need to restart the splunk universal forwarder service and adjust your inputs on your receiving indexer.

[tcpout:my_indexers]
server=INDEXER_IP_OR_HOSTNAME.DOMAINNAME:9997

the inputs.conf on the indexer should look something like this. Same goes for restarting the indexer after the change.

[splunktcp://FORWADER_IP_OR_HOSTNAME.DOMAINNAME:9997]
disabled = false
connection_host = none
compressed = true

This is the bare minimum you can do to change it as far as i know.
Im not sure how you'd do it if you have a deployment server.

[mayurr98]

hey,

have a look at this answer which is already available.
https://answers.splunk.com/answers/58888/what-are-the-ports-that-i-need-to-open.html

let me know if this helps!

[pfabrizi]

So it is the mgmt. port that is in conflict. I used the out of the box 8089 to communicate with deployment server, changed it to 8090 and now that is conflicting with our VM center.
What I want to change the UF management port to 80899 and just wasn't sure if I can do this.

Thanks!

[493669]

8089 is management port i.e. for splunkd
try 9997 for forwarders to the Splunk indexer which is default one