Thank you so much for your reply. To be specific, we have full distributed environment with IDX and SH into cluster. We are taking input from UF, REST API, DB connect and syslog, etc. Can you share the exclusive ports that I can miss apart from the standard Splunk ports.
It depends on your exact setup, but common ports are (all TCP)
8000 for web
8089 for api
9997 and 9998 for forwarders (non SSL and SSL)
9000 for idx replication (although this could be anything)
DB connect will use relevant ports for your DB engines, but those will be egress from DBX