TCP data input

[athannie92]

Hey I am trying to put data into my splunk using the TCP option and splunk is asking for my tcp port but I dont know what port to use. What should I put? Thank you

[MuS]

Hi athannie92,

are your talking about recieving Splunk TCP inputs from universal forwarders? If so the default port will be 9997.

If you want Splunk to receive general TCP traffic as data input, you can set any free TCP port. There are some things to remember, if you run Splunk as non-root this port must be higher than 1024 and it must not be take by any other running process. Also check for any local firewall on your server which could block your port.

Ask your System Admin for help on getting a free port and local firewall.

hope this helps ...

cheers, MuS