Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- light-forwarder question
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
The local Splunk folks recommended we switch from a universal forwarder to a light-forwarder in our dev env. I installed the full splunk image, and enabled light-forwarding, but now I'm seeing "Connection to XX.XX.XXX.XX:8089 closed. Read error. Connection reset by peer" messages. I enabled light-fowarding, and added the forwarder destination. Is this port right? Not sure what I missed here...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Port 8089 is used for intra-splunk communication (license info, deployment traffic, etc), not for sending and receiving logs. You should configure the forwarder to send its logs to a port that has been setup for receiving forwarded logs on the indexer - which port number it has depends on what port the indexer has been configured to use, but port 9997 is commonly used for this.
Some docs on the subject:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Deploymentoverview
http://docs.splunk.com/Documentation/Splunk/4.3.2/Deploy/DeployaWindowsdfmanually
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Port 8089 is used for intra-splunk communication (license info, deployment traffic, etc), not for sending and receiving logs. You should configure the forwarder to send its logs to a port that has been setup for receiving forwarded logs on the indexer - which port number it has depends on what port the indexer has been configured to use, but port 9997 is commonly used for this.
Some docs on the subject:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Deploymentoverview
http://docs.splunk.com/Documentation/Splunk/4.3.2/Deploy/DeployaWindowsdfmanually
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Duh. OK. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, you only need one output per indexer from the forwarder, regardless of how many sources (files, ports, scripts, ...) the forwarder has.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ah, gatcha. Wasn't sure if there was some sort of "funnel", where I read from different ports and sent them over a different one. So, if I read 3 different ports, I should have 3 corresponding outputs to the indexer?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am seeing it in the splunkd.log on the agent server. I used port 8089 as the forwarder port - I don't see any doc that states what port to use.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where are you seeing this error? What port did you configure the forwarder to send its events to?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26
Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM
Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas
