Getting Data In

What are the ports that I need to open?

antoaravinth
Engager

Hi, for Splunk to work properly, what are the ports that I need to open?

Can anyone specify the inbound ports and outbound ports?

Labels (1)
Tags (3)
1 Solution

mikelanghorst
Motivator

defaults are
9997 for forwarders to the Splunk indexer.
8000 for clients to the Splunk Search page
8089 for splunkd (also used by deployment server).

All of these can be changed if desired.

View solution in original post

malmoore
Splunk Employee
Splunk Employee

The Splunk Documentation has a page that discusses which ports need to be opened, and has diagrams for both standalone and distributed deployments:

Components and their relationship with the network - in the Inherited Deployments Manual

nickhills
Ultra Champion

I know I'm late to this party, but I thought I would add my diagrams to the mix:

Basic Architecture

basic Splunk Architecture
Clustered Architecture
Clustered Splunk Architecture

If my comment helps, please give it a thumbs up!

bandit
Motivator

Nice use of colors. One change you may want to review is the direction on the deployer arrows. My understanding is that clients do a pull form a Deployment Server vs the Deployer initiating a push to search peers in a cluster.

Rob

0 Karma

nadid
Path Finder

Is there an updated version of this visio for clustered search heads and indexers?

0 Karma

bandit
Motivator

Per request, source Visio diagrams are here:
http://downloads.jordan2000.com/splunk/

mnatkin_splunk
Splunk Employee
Splunk Employee

I've taken the liberty of updating the diagram slightly to reflect both changes in code since 6.2 and recommendations between this and one other post.

JPG format: https://drive.google.com/open?id=0B3PXaVtuNWbnMzJ6bTlkcXRmMFE
Visio format: https://drive.google.com/open?id=0B3PXaVtuNWbnRGtyM2phX2tWQ3M

Thanks @rob_jordan for the great effort and for sharing!

mcronkrite
Splunk Employee
Splunk Employee

Also note that for Search Head Clustering there is a new replication port that you can pick, e.g. 8181. Also with SHC you need the KV store port (by default, 8191) must be available to all other members. You can use the CLI command splunk show kvstore-port to identify the port number.
The replication port must be available to all other members.

renems
Communicator

Since splunk 6.2 also port 8191 is used for the kvstore.

nitinsheenu
Explorer

It seems many are confused about port required from UFs to a HF. Which is 9997 too i.e.

UFs ---9997---> HF --- 9997---> Indexers
UFs, Indexers, SHs ---8089 ---> DS

Many uses HF & DS as same server.

bandit
Motivator

This is a diagram of Splunk components and network ports that are commonly used in a Splunk Enterprise environment. Firewall rules often need to be updated to allow communication on ports 8000, 8089, 9997, 514 and others.

Source files available here: http://downloads.jordan2000.com/splunk/

Updated version
alt text

Original version
alt text

balsa3d
New Member

Many thanks for sharing. this is very useful, clear.

0 Karma

jdinkel
Explorer

Little typo there on the MANAGEMENT TIER.

Does anybody have a version of this made specifically for opening firewall ports between an on-premise installation and splunkcloud.com?

Thanks!

jdinkel
Explorer

This is excellent. Very helpful.

0 Karma

srinivasank
New Member

I downvoted this post because for analysis

0 Karma

horsefez
SplunkTrust
SplunkTrust

Amazing, exactly what I needed

0 Karma

malmoore
Splunk Employee
Splunk Employee

We're working on getting this or something like this added to the main documentation. We'll keep you posted on where and when (soon!)

0 Karma

sk314
Builder

Thank you for this diagram, kind sir.

0 Karma

koshyk
Super Champion

@rob_jordan : Your picture speaks 100000k words 🙂 very helpful

0 Karma

steven_swor
Path Finder

Wow. Nicely done. This is so hard to find in the official documentation.

I would also suggest adding flows on port 9997 from the search heads, deployment server, license server, and cluster master to the indexers, with a footnote that this is an optional flow used for forwarding Splunk's internal indexes (a recommended best practice).

bandit
Motivator

@steven_swor I've added your recommendation.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.