Network prerequisites Splunk Universal Forwarder

[michaelteck]

Hello everyone, 

In my splunk journey, I've to make a documentation for the installation of the Universal Forwarder.
Ours Forwarders will be install VMs who are on a private network so we need some configuration on the network to let the Universal Forwarder to send data to the indexers splunk.
Ours indexers are install on another private network, we created a rule on the network to receive data on the port 9997 of the Splunk server.
I'm looking for network prerequisites before the installation of the fowarder.
What rules we have to create on the Forwarder's network ?
What port we have to open on the Forwarder's network ?
Do we need to create a specific flow for the Forwarder to send data to the indexers?
What protocol we have to setup on the Forwarder's network?

Thank for all who read me,

[kiran_panchavat · Accepted solution]

@michaelteck 

The Splunk Documentation has a page that discusses which ports need to be opened, and has diagrams for both standalone and distributed deployments: https://docs.splunk.com/Documentation/Splunk/latest/InheritedDeployment/Ports 

https://kinneygroup.com/blog/splunk-default-ports/ 

If my comment helps, please give it a thumbs up!

[isoutamo]

Hi

here is network diagram which describes which ports and what directions should/must be open. https://www.aplura.com/assets/pdf/splunk_common_ports.pdf

r. Ismo