Security

Splunk DB connect

ffrig
New Member

I have a firewall between my indexer and MySLQ DB. What port(s) does the indexer use to make connections and queries? It is just 8000, 8089 or others? I'm connecting through to the standard 3306 port for MySQL. Thanks!

0 Karma

ffrig
New Member

Did a trace and found the answer myself - random high port:
netstat -an | grep 172.27.67.174
tcp 0 1 ::ffff:172.27.91.38:41717 ::ffff:172.27.67.174:3306 SYN_SENT

0 Karma

sowings
Splunk Employee
Splunk Employee

Oh, so you needed the source port.

0 Karma

ffrig
New Member

Thanks all, but I was after what the source port would be from the indexer to the DB server. Wasn't sure if this was a random high port or from Splunk Web?

0 Karma

kristian_kolb
Ultra Champion

You'll need to allow the connection from the Splunk instance to the DB, which in your case seems to be port 3306.

Port 8000 is the default port where splunkweb is running. It has nothing to do with DBConnect. But of course you'll have to allow inbound traffic to the Splunk server on that port for users connecting with their browsers.

Port 8089 is used by various splunk instances (forwarders, indexers, search heads etc)to talk to each other (deployment traffic, distributing searches etc).

Port 9997 is commonly used for sending log traffic from forwarders to indexers.

/K

0 Karma

gfuente
Motivator

Hello

You only need the 3306, as long as you don't install a forwarder in the db server.

regards

sowings
Splunk Employee
Splunk Employee

The indexer would initiate a connection from its side to the MySQL database, on whatever port the database is running. In your case, that's 3306.

Have you tried this and encountered an issue?