How to send data to indexer and pulling config data from deployment server using forwarder ports?

[brdr]

We will be installing the forwarder onto our domain controllers in DMZ.

Question, can we hardwire a port on the DC where the forwarder is installed to connect to :

1. deployment server on 8089
2. indexers on 9997

[Heff]

Yes,

When you install the forwarder just specify the DS server & Port like this:

msiexec.exe /i Splunk.msi DEPLOYMENT_SERVER=host:port /quiet

Then you should create an outputs App on your DS that will push just an outputs.conf to all your Forwarders.

Make sense?
http://docs.splunk.com/Documentation/Splunk/6.5.0/Installation/InstallonWindowsviathecommandline

[brdr]

makes sense. however, if I want to lock down a port on the forwarder sitting in DMZ to use a port to communicate to 8089 on deployment server and to communicate to 9997 on indexers how do I do that? Where do I specify the port on the forwarder to communicate to DS and IDX?

[Heff]

the deploymentclient.conf will have the server:port in it and the outputs.conf will have the indexer server:port in it too. Additionally the indexer and DS are only listening on those same ports.

http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Deploymentclientconf
http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Outputsconf