Deployment Architecture

Required network openings for a distributed Splunk setup

mart10
Path Finder

I apologize if the title isn't very descriptive of the question I have, was not sure how to best frame it.

For a setup with numerous splunkforwarders forwarding to two indexing servers, and getting inputs/outputs from a deployment server, how is the network flow?

splunkforwarder -> splunk-index1/2 - is this forwarder-initiated?
splunk-master (deployment+cluster master) -> splunkforwarder - master or forwarder initiated for deployment of config/splunkd restarts?

I believe I found some information on this at some point, but that was for an older version and possibly outdated.

Labels (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Yes, those are correct.

View solution in original post

mart10
Path Finder

Thanks, just so I am sure I properly understand this:

splunkforwarder -> indexers # this is forwarder-polling/initiated on port 9997.
splunkforwarder -> deployment # this is also forwarder-polling/initiated, port 8089.
indexer/deployment/head -> license server # this is indexer/deployment/head-polling on port 8089.

So overall, splunkforwarders initiates every connection to their mothership. And splunk servers initiates connections to the license server.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Yes, those are correct.

inventsekar
SplunkTrust
SplunkTrust

Hi @mart10 

splunk-master (deployment+cluster master) -> splunkforwarder - master or forwarder initiated for deployment of config/splunkd restarts? /// 

on Deployment server, when you make changes (to inputs.conf, etc), the changes will be sent to universal forwarders - In some cases, it deploys apps automatically. In other cases, you need to manually initiate the deployment.

https://docs.splunk.com/Documentation/Splunk/8.0.6/Updating/Updateconfigurations

 

The phone home interval (that is, how frequently each client checks in with the deployment server for updates)

https://docs.splunk.com/Documentation/Splunk/8.0.6/Updating/Calculatedeploymentserverperformance

phoneHomeIntervalInSecs = <number in seconds>
* Determines how frequently, in seconds, this deployment client should
  check for new content.
* Fractional seconds are allowed.
* Default: 60.
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Deploymentclientconf

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
here is diagram how nodes are connected together and which node is active on which connection.
https://docs.splunk.com/Documentation/Splunk/8.0.6/InheritedDeployment/Ports
r. Ismo
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...