Whether port 8089 should be opened bi-directional or uni-directional between forwarder and indexer ? In our setup, there is a firewall between forwarder and indexers, and I need to tell the firewall team about the same. I am asking them to open it bi-directional, but they are not allowing it. They need some Splunk documentation to support this as evidence.
Please clarify the direction and also point me some Splunk document, wherein I can show them as evidence, if bi-directional port opening is required.