Getting Data In

What port splunk universal forwarder use to sent data to the indexer on splunk instance?

royimad
Builder

What is the port that splunk universal forwareder use to sent data to the indexer on a splunk instance, what protocol need to exist between universal forwarder and the splunk instance?

Tags (1)
0 Karma
1 Solution

datasearchninja
Communicator

It is whatever you set it to. The port in outputs.conf on the forwarder needs to match the port in inputs.conf on the indexer

See the doco

View solution in original post

0 Karma

stefano_guidoba
Communicator

By default, it's port 9997. Please refer to Splunk Docs to obtain further information on this topic. And remember you can change receiving/admin ports as you please (for example, in case of 2 splunk installations on the same host).

Splunk Docs

Regards,
Stefano

0 Karma

datasearchninja
Communicator

It is whatever you set it to. The port in outputs.conf on the forwarder needs to match the port in inputs.conf on the indexer

See the doco

0 Karma

Ayn
Legend

If a port on the system is already used by an application then by definition it is not available to be used by other applications.

royimad
Builder

Just to confirm more your answer - Can i use an existing port used and opened?

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...