Knowledge Management

New ports open in Splunk 6, how are they utilized?

pkhalsa
New Member

At the "About upgrading to 6.2 - READ THIS FIRST" page, it states:
"This opens two network ports by default on the local machine: 8191 (for KV Store) and 8065 (for Appserver.) "

I want to upgrade my Splunk 5 search head to Splunk 6 today and upgrade all my indexers next week. In the meantime, I wanted to know if the indexers and search head will be communicating on these new ports? I assume so, but this statement isn't so explicit. When it says the ports are opened "on the local machine," it's not clear who the local machine will be communicating with when the new ports are opened.
Thanks.

Tags (2)
0 Karma

malmoore
Splunk Employee
Splunk Employee

The new network ports for Splunk Enterprise 6.2 are open for connections to the local instance. This means that other instances (such as search head cluster members, indexer cluster members, etc.) that use App Key Value Store (port 8191) and Appserver (8065) use these ports to handle those specific operations. If you block those ports, that communication can't happen.

Jrubalcaba
Explorer

Are these ports inbound or outbound?

0 Karma

malmoore
Splunk Employee
Splunk Employee

They are inbound, meaning that the Splunk process listens for connections from other hosts on these ports.

pkhalsa
New Member

Thanks. Will App Key Value Store and Appserver be turned on automatically when I upgrade? Are they essential for Splunk 6 to operate? Otherwise I'm not sure I necessarily need to open up those ports.

0 Karma

malmoore
Splunk Employee
Splunk Employee

Yes, both will be turned on when you upgrade. You should determine whether or not you need to use both features before disabling them. A number of apps use App Key Value a Store, for example.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...