Getting Data In

Can someone help me understand how protocols, permissions, and communication are configured for universal forwarders?

  1. Protocols, I am assuming that everything is running on TCP, but perhaps UDP is required as well
  2. Permission, there is no mention on permission set for the Splunk Universal forwarder. This should be run on an account other than admin. We need to get very specific here.
  3. Network communication instantiation. Is communication with the universal forwarder bi-lateral or uni-lateral pushing information out? This will be important for the firewall rules to be setup properly.
0 Karma


Let's cover both network related questions together:

Splunk forwarders send data to Splunk servers via TCP. All communication from the forwarders are initiated from the forwarders. If you are using the deployment server to manage your config, your Splunk forwarder will initiate a TCP connection on port 8089 to the deployment server to update its configuration. To forward log data, your Splunk forwarder initiates a connection to your indexer(s) on port 9997. You can remap these ports if necessary.

By permission, do you mean the user that the Splunk forwarder runs as? This will depend on if you are running your forwarders on unix or windows. Generally speaking, you can run as any user as long as that user has read/write access to the Splunk installation directory and has read access to the files you would like to index.

This document goes into detail about Windows permissions to run Splunk (including your forwarders):

There is a similar document for Unix systems.

Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...