What ports need to be opened on the Windows 10 Defender Firewall to allow communication between the Universal Forwarder and Splunk?

[rayeverestnatur]

I am trying to connect a Universal Forwarder on a Windows 10 computer to Splunk on another Windows 10 computer.

[rayeverestnatur]

Is port 9997 the only port which must be opened on the firewall. Is the port TCP?

[ddrillic]

9997 to each indexer and 8089 to the deployment server, if used - all TCP.

[renjith_nair]

Hi @rayeverestnature,

Splunk uses port 9997 between a UF/HF and indexer . Please refer here to have a comprehensive network port diagram

https://docs.splunk.com/Documentation/Splunk/7.1.1/InheritedDeployment/Ports

[ddrillic]

And port 8089 to the deployment server.