Multisite Indexer Cluster Replication Port

[gcusello]

Hi at all,

I have to configure a multisite Indexer Cluster and I have a dubt:

in the Splunk architectig course, the indicated Indexer Cluster replication port was 9100.

Then reading Multisite Indexer Cluster documentation the indicated port is 9887.

What's the correct one?

Can I use 9100 instead 9887 or 9100 is dedicated to other purposes?

Thank you for your support.

Ciao.

Giuseppe

[richgalloway · Accepted solution]

As I understand it, there is no default replication port.  The cluster will use whatever is in the [replication_port://<port>] or [replication_port-ssl://<port>] stanza.

[isoutamo]

As @richgalloway said, there is no “default” ports, just examples. You could choose what ever you want.

[inventsekar]

For new Splunk learners reference, this should be done on server.conf file:

https://docs.splunk.com/Documentation/Splunk/9.1.1/admin/serverconf

All default ports listed:

https://docs.splunk.com/Documentation/Splunk/9.1.1/InheritedDeployment/Ports