Allow Splunk Server out through firewall.....

[LandersFiscal]

Hi guys, my apologies upfront for the question, I've searched and I can't seem to find the answer to this.

I'm putting splunk behind our PCI firewall, I need to know the IP's/Ports are needed for it to get out to function "normally". IE, if I click on the find more apps online, that it can. I can't do an access list with ANY eq 80 or ANY eq 443 I have to have specific IP's. Thanks in advance!

[Strype]

8000, 9996, 8089. The ip will be whatever you assigned your servers, forwarders, peers, etc.

[Strype]

Splunk web will take the IP of the machine.

[Strype]

Okay I see. I must have misread. I assumed you were using a distributed architecture and that the firewalls were on the servers.

[LandersFiscal]

So that allows the splunk server, to access the community? That looks more like what the hosts use to connect back to the splunk server, correct?