Splunk Dev

Which port do we use to forward data from a HF to indexer, when we already have multiple UF sending logs to HF on port 9997?

Akhilprakash
New Member

UFs ---9997---> HF --- 9997---> Indexers

We have above structured architecture, where multiple UF will send logs to HF and HF will forward those logs to Indexer.
HF is configured to receive logs from UF on port 9997, Now which port I have to use to forward data from HF to indexer?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Your configuration is just fine as-is, assuming you are sticking with the defaults.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Your configuration is just fine as-is, assuming you are sticking with the defaults.

0 Karma

Akhilprakash
New Member

Sticking with the defaults as we are receiving and sending on port 9997 from HF. But will there be any conflict when both receiving and sending happens on the same port?

0 Karma

FrankVl
Ultra Champion

The HF won't be sending from 9997, it will send from some random port, to port 9997 on the Indexers. Network traffic doesn't travel 'on' a port, it travels from a source port to a destination port.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...