Hi guys, my apologies upfront for the question, I've searched and I can't seem to find the answer to this.
I'm putting splunk behind our PCI firewall, I need to know the IP's/Ports are needed for it to get out to function "normally". IE, if I click on the find more apps online, that it can. I can't do an access list with ANY eq 80 or ANY eq 443 I have to have specific IP's. Thanks in advance!
8000, 9996, 8089. The ip will be whatever you assigned your servers, forwarders, peers, etc.
Splunk web will take the IP of the machine.
Okay I see. I must have misread. I assumed you were using a distributed architecture and that the firewalls were on the servers.
So that allows the splunk server, to access the community? That looks more like what the hosts use to connect back to the splunk server, correct?