Port on the server and the network seems open for 9998 port for indexers to receive data but only 1 out of the 3 indexer is able to get data from forwarder service.
Is there anything on the console I need to ensure that 9998 port is open and Splunk can receive data from forwarders.
Must not be blocked by firewall on either end. Must be route from forwarder to Indexer. ACL must be OK. Forwarder's
outputs.conf must have all 3 Indexers defined. All Indexers must have the same
inputs.conf settings. Try
splunk list inputstatus on each Indexer and compare.
It seems you have a solution for me....I fired the command on all the 3 indexers we have and only one server showed below result.
Else for this other 2 indexer in cluster show
Now please suggest where is the setting from where I can get the 9998 port opened.
Thanks a lot for the initial finding help.
Yes you can add another listening port by either:
a) Using the GUI by going to
Data Inputs ->
b) Using the command-line command, ./splunk enable listen 9998 -auth admin:change me # Needs option for SSL
c) editing the inputs.conf file and adding a new stanza like this:
[splunktcp-ssl:9998] compressed = true
See this documentation:
Regarding SSL encryption, you need to decide whether you want to use your own certificates or the ones supplied by Splunk. I suggest you read this: