Getting Data In

How to send data to indexer and pulling config data from deployment server using forwarder ports?

brdr
Contributor

We will be installing the forwarder onto our domain controllers in DMZ.

Question, can we hardwire a port on the DC where the forwarder is installed to connect to :

  1. deployment server on 8089
  2. indexers on 9997
0 Karma

bheffernan_splu
Splunk Employee
Splunk Employee

Yes,

When you install the forwarder just specify the DS server & Port like this:

msiexec.exe /i Splunk.msi DEPLOYMENT_SERVER=host:port /quiet

Then you should create an outputs App on your DS that will push just an outputs.conf to all your Forwarders.

Make sense?
http://docs.splunk.com/Documentation/Splunk/6.5.0/Installation/InstallonWindowsviathecommandline

0 Karma

brdr
Contributor

makes sense. however, if I want to lock down a port on the forwarder sitting in DMZ to use a port to communicate to 8089 on deployment server and to communicate to 9997 on indexers how do I do that? Where do I specify the port on the forwarder to communicate to DS and IDX?

0 Karma

bheffernan_splu
Splunk Employee
Splunk Employee

the deploymentclient.conf will have the server:port in it and the outputs.conf will have the indexer server:port in it too. Additionally the indexer and DS are only listening on those same ports.

http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Deploymentclientconf
http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Outputsconf

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!