What port splunk universal forwarder use to sent data to the indexer on splunk instance?

[royimad]

What is the port that splunk universal forwareder use to sent data to the indexer on a splunk instance, what protocol need to exist between universal forwarder and the splunk instance?

[stefano_guidoba]

By default, it's port 9997. Please refer to Splunk Docs to obtain further information on this topic. And remember you can change receiving/admin ports as you please (for example, in case of 2 splunk installations on the same host).

Splunk Docs

Regards,
Stefano

[datasearchninja · Accepted solution]

It is whatever you set it to. The port in outputs.conf on the forwarder needs to match the port in inputs.conf on the indexer

See the doco

[Ayn]

If a port on the system is already used by an application then by definition it is not available to be used by other applications.

[royimad]

Just to confirm more your answer - Can i use an existing port used and opened?