Deployment Architecture

Network prerequisites Splunk Universal Forwarder

michaelteck
Explorer

Hello everyone, 

In my splunk journey, I've to make a documentation for the installation of the Universal Forwarder.
Ours Forwarders will be install VMs who are on a private network so we need some configuration on the network to let the Universal Forwarder to send data to the indexers splunk.
Ours indexers are install on another private network, we created a rule on the network to receive data on the port 9997 of the Splunk server.
I'm looking for network prerequisites before the installation of the fowarder.
What rules we have to create on the Forwarder's network ?
What port we have to open on the Forwarder's network ?
Do we need to create a specific flow for the Forwarder to send data to the indexers?
What protocol we have to setup on the Forwarder's network?

Thank for all who read me,

Labels (1)
0 Karma
1 Solution

kiran_panchavat
Contributor

@michaelteck 

The Splunk Documentation has a page that discusses which ports need to be opened, and has diagrams for both standalone and distributed deployments: https://docs.splunk.com/Documentation/Splunk/latest/InheritedDeployment/Ports 

https://kinneygroup.com/blog/splunk-default-ports/ 

kiran_panchavat_0-1710785265231.png

 

kiran_panchavat_2-1710785322256.png

If my comment helps, please give it a thumbs up!

 
 

View solution in original post

kiran_panchavat
Contributor

@michaelteck 

The Splunk Documentation has a page that discusses which ports need to be opened, and has diagrams for both standalone and distributed deployments: https://docs.splunk.com/Documentation/Splunk/latest/InheritedDeployment/Ports 

https://kinneygroup.com/blog/splunk-default-ports/ 

kiran_panchavat_0-1710785265231.png

 

kiran_panchavat_2-1710785322256.png

If my comment helps, please give it a thumbs up!

 
 

isoutamo
SplunkTrust
SplunkTrust

Hi

here is network diagram which describes which ports and what directions should/must be open. https://www.aplura.com/assets/pdf/splunk_common_ports.pdf

r. Ismo

Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...