Required network openings for a distributed Splunk setup

[mart10]

I apologize if the title isn't very descriptive of the question I have, was not sure how to best frame it.

For a setup with numerous splunkforwarders forwarding to two indexing servers, and getting inputs/outputs from a deployment server, how is the network flow?

splunkforwarder -> splunk-index1/2 - is this forwarder-initiated?
splunk-master (deployment+cluster master) -> splunkforwarder - master or forwarder initiated for deployment of config/splunkd restarts?

I believe I found some information on this at some point, but that was for an older version and possibly outdated.

[mart10]

Thanks, just so I am sure I properly understand this:

splunkforwarder -> indexers # this is forwarder-polling/initiated on port 9997.
splunkforwarder -> deployment # this is also forwarder-polling/initiated, port 8089.
indexer/deployment/head -> license server # this is indexer/deployment/head-polling on port 8089.

So overall, splunkforwarders initiates every connection to their mothership. And splunk servers initiates connections to the license server.

[isoutamo · Accepted solution]

Yes, those are correct.

[inventsekar]

Hi @mart10 

splunk-master (deployment+cluster master) -> splunkforwarder - master or forwarder initiated for deployment of config/splunkd restarts? /// 

on Deployment server, when you make changes (to inputs.conf, etc), the changes will be sent to universal forwarders - In some cases, it deploys apps automatically. In other cases, you need to manually initiate the deployment.

https://docs.splunk.com/Documentation/Splunk/8.0.6/Updating/Updateconfigurations

The phone home interval (that is, how frequently each client checks in with the deployment server for updates)

https://docs.splunk.com/Documentation/Splunk/8.0.6/Updating/Calculatedeploymentserverperformance

phoneHomeIntervalInSecs = <number in seconds>
* Determines how frequently, in seconds, this deployment client should
  check for new content.
* Fractional seconds are allowed.
* Default: 60.
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Deploymentclientconf

[isoutamo]

Hi
here is diagram how nodes are connected together and which node is active on which connection.
https://docs.splunk.com/Documentation/Splunk/8.0.6/InheritedDeployment/Ports
r. Ismo