Replication Port

[agodoy]

Planning my Splunk cluster.

The replication port is defined as "This is the port on which the peer receives replicated data streamed from the other peers. You can specify any available port for this purpose. "

Can all search peers use the same replication port?
Does the cluster master need to communicate on this port?
What about a search head?
Is communication Bidirectional?
Is the protocol TCP?

I am basically trying to see what firewall changes I need to make.

[okrabbe_splunk]

Can all search peers use the same replication port?

Yes peers should have the same replication port

Does the cluster master need to communicate on this port?

No, this is configurable but usually the same as the management port (8089 by default)

What about a search head?

8089 by default

Is communication Bidirectional?

I believe the answer is yet but the peers will initiate connections with the master. maybe others can fill in more info here.

Is the protocol TCP?

Yes

Don't forget your forwarder receiving port which is often set to 9997.