9998 port to open

[vikram_m]

Port on the server and the network seems open for 9998 port for indexers to receive data but only 1 out of the 3 indexer is able to get data from forwarder service.

Is there anything on the console I need to ensure that 9998 port is open and Splunk can receive data from forwarders.

[woodcock · Accepted solution]

Must not be blocked by firewall on either end. Must be route from forwarder to Indexer. ACL must be OK. Forwarder's outputs.conf must have all 3 Indexers defined. All Indexers must have the same inputs.conf settings. Try splunk list inputstatus on each Indexer and compare.

[vikram_m]

Thanks Woodcock

It seems you have a solution for me....I fired the command on all the 3 indexers we have and only one server showed below result.

tcp_cooked:listenerports :
9997

    9998

Else for this other 2 indexer in cluster show

tcp_cooked:listenerports :
9997

Now please suggest where is the setting from where I can get the 9998 port opened.

Thanks a lot for the initial finding help.

Thanks.
Vikram.

[woodcock]

Yes you can add another listening port by either:
a) Using the GUI by going to Settings -> Data Inputs -> TCP -> New
b) Using the command-line command, ./splunk enable listen 9998 -auth admin:change me # Needs option for SSL
c) editing the inputs.conf file and adding a new stanza like this:

[splunktcp-ssl:9998]
compressed = true

See this documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutforwardingandreceivingdata

Regarding SSL encryption, you need to decide whether you want to use your own certificates or the ones supplied by Splunk. I suggest you read this:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/UseSSLtoencryptandauthenticatedatafromforwa...