Getting Data In
Highlighted

9998 port to open

Path Finder

Port on the server and the network seems open for 9998 port for indexers to receive data but only 1 out of the 3 indexer is able to get data from forwarder service.

Is there anything on the console I need to ensure that 9998 port is open and Splunk can receive data from forwarders.

0 Karma
Highlighted

Re: 9998 port to open

Esteemed Legend

Must not be blocked by firewall on either end. Must be route from forwarder to Indexer. ACL must be OK. Forwarder's outputs.conf must have all 3 Indexers defined. All Indexers must have the same inputs.conf settings. Try splunk list inputstatus on each Indexer and compare.

View solution in original post

0 Karma
Highlighted

Re: 9998 port to open

Path Finder

Thanks Woodcock

It seems you have a solution for me....I fired the command on all the 3 indexers we have and only one server showed below result.

tcp_cooked:listenerports :
9997

    9998

Else for this other 2 indexer in cluster show

tcp_cooked:listenerports :
9997

Now please suggest where is the setting from where I can get the 9998 port opened.

Thanks a lot for the initial finding help.

Thanks.
Vikram.

0 Karma
Highlighted

Re: 9998 port to open

Esteemed Legend

Yes you can add another listening port by either:
a) Using the GUI by going to Settings -> Data Inputs -> TCP -> New
b) Using the command-line command, ./splunk enable listen 9998 -auth admin:change me # Needs option for SSL
c) editing the inputs.conf file and adding a new stanza like this:

[splunktcp-ssl:9998]
compressed = true

See this documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutforwardingandreceivingdata

Regarding SSL encryption, you need to decide whether you want to use your own certificates or the ones supplied by Splunk. I suggest you read this:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/UseSSLtoencryptandauthenticatedatafromforwa...

0 Karma