Splunk Heavy forwarder: How to fix the problem on port 9997?

[MayurMangoli]

HI,

i'm facing one of the issue on my heavy forwarder is not able to get the logs on 9997, where we have already configured the UF for port 9997 and receiving port 9997 on HF, but from the source to HF we telnet the HF on port 9997, for the first time it gets connected very next time it failed to connect.

due to this we have not receving UF logs on the

[jotne]

You are 100% sure your HF are listening on port 8089.

ss -pultan | grep LISTEN

should result in some like this:

tcp    LISTEN  0       128                  0.0.0.0:8089         0.0.0.0:*       users:(("splunkd",pid=3870899,fd=4))

[gcusello]

Hi @MayurMangoli,

did you permanently disabled the local firewall on the HF?

Ciao.

Giuseppe