Getting Data In

What port number do deployment servers use to communicate with the forwarder?

Path Finder


I can ping Telnet 8089 from forwarder to deployment server, but when I push the app from deployment server, it is not reflected in the forwarder (serverclass is correctly configured). Can I please know:
1. How do you troubleshoot this kind of issue?
2. What port number do deployment servers use to communicate with the forwarder?

0 Karma

Esteemed Legend

If you are on the DC and sitting in any directory of the app waiting to see a file change, you never will because the DC will rename the app that you are in, create a new app from the DS and do some merging before deleting the old/renamed app. You have to sit in some other directory and do cat $SPLUNK_HOME/etc/apps/<your app name here>/*/<your conf file here>,conf to test/watch for the change to pull down.

0 Karma

Ultra Champion

Do you see the respective forwarder reporting into the deployment server, when you go to settings -> forwarder management on the web gui of the deployment server?

What does splunkd.log say on the forwarder about its attempts to connect to the deployment server?

If you need further help troubleshooting, please also at least share the relevant part of the serverclass configuration. (maybe best to just open a new question for that)

0 Karma

Esteemed Legend

None. The DS does not initiate communication with DCs; it is always the other way around. The default port that DCs use is 8089 but it is not uncommon to change this.


Hi @kteng2024,

This answer is easily resolved with this other response:

[ ]s

0 Karma


Port 8089 traffic should be bidirectional, so check that you can telnet to 8089 from the deployment server to the forwarder.

Esteemed Legend

You are incorrect. The DS NEVER initiates.

0 Karma


I downvoted this post because this is incorrect. a uf does a pull from the ds and doesn't require port 8089 open. the uf 8089 listening admin port can be disabled

Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...