Getting Data In

TCP data input

athannie92
New Member

Hey I am trying to put data into my splunk using the TCP option and splunk is asking for my tcp port but I dont know what port to use. What should I put? Thank you

Tags (1)
0 Karma

MuS
Legend

Hi athannie92,

are your talking about recieving Splunk TCP inputs from universal forwarders? If so the default port will be 9997.

If you want Splunk to receive general TCP traffic as data input, you can set any free TCP port. There are some things to remember, if you run Splunk as non-root this port must be higher than 1024 and it must not be take by any other running process. Also check for any local firewall on your server which could block your port.

Ask your System Admin for help on getting a free port and local firewall.

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...