Installation

What port should I use to connect to a private server (Azure)?

saranyasubburaj
New Member

I want to connect the server which is in Azure (private network) to Splunk indexer server , which port should be opened in order to establish the connection?

0 Karma
1 Solution

woodcock
Esteemed Legend

See port details here (including excellent diagram):
https://www.aplura.com/splunk-best-practices/

Carefully and consistently use Splunk’s listening ports, which bind to specific back-end processes. Some of these are referenced when Splunk starts. Generally speaking here are the standard ports, if they have not been altered:
tcp/8089 – splunkd – Splunk’s daemon port used for distributed search and deployment server.
tcp/8000 – splunkweb – Splunk’s web port used for web UI access.
tcp/8191 – kvstore – Splunk’s key value store.
tcp/9887 – Index cluster replication – Port commonly used to replicate Splunk data in index clustering environments. Note: This can be any permissible port, 9887 is just an example.
tcp/9997 – splunktcp listener – Port commonly used to send events from a Splunk forwarder to a Splunk listener (indexer or another forwarder). Note: This can be any permissible port, 9997 is just an example.
tcp/9998 – splunktcp SSL listener – Port commonly used to send events from a Splunk forwarder to a Splunk listener (indexer or another forwarder) using encryption. Note: This can be any permissible port, 9998 is just an example.

View solution in original post

woodcock
Esteemed Legend

See port details here (including excellent diagram):
https://www.aplura.com/splunk-best-practices/

Carefully and consistently use Splunk’s listening ports, which bind to specific back-end processes. Some of these are referenced when Splunk starts. Generally speaking here are the standard ports, if they have not been altered:
tcp/8089 – splunkd – Splunk’s daemon port used for distributed search and deployment server.
tcp/8000 – splunkweb – Splunk’s web port used for web UI access.
tcp/8191 – kvstore – Splunk’s key value store.
tcp/9887 – Index cluster replication – Port commonly used to replicate Splunk data in index clustering environments. Note: This can be any permissible port, 9887 is just an example.
tcp/9997 – splunktcp listener – Port commonly used to send events from a Splunk forwarder to a Splunk listener (indexer or another forwarder). Note: This can be any permissible port, 9997 is just an example.
tcp/9998 – splunktcp SSL listener – Port commonly used to send events from a Splunk forwarder to a Splunk listener (indexer or another forwarder) using encryption. Note: This can be any permissible port, 9998 is just an example.

s2_splunk
Splunk Employee
Splunk Employee

Assuming that "the server which is in Azure" is actually a Splunk forwarder, your Splunk admin can tell you which TCP port she/he has configured to receive data on. The default port is 9997.

More details

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...