Splunk DB connect

[ffrig]

I have a firewall between my indexer and MySLQ DB. What port(s) does the indexer use to make connections and queries? It is just 8000, 8089 or others? I'm connecting through to the standard 3306 port for MySQL. Thanks!

[ffrig]

Did a trace and found the answer myself - random high port:
netstat -an | grep 172.27.67.174
tcp 0 1 ::ffff:172.27.91.38:41717 ::ffff:172.27.67.174:3306 SYN_SENT

[sowings]

Oh, so you needed the source port.

[ffrig]

Thanks all, but I was after what the source port would be from the indexer to the DB server. Wasn't sure if this was a random high port or from Splunk Web?

[kristian_kolb]

You'll need to allow the connection from the Splunk instance to the DB, which in your case seems to be port 3306.

Port 8000 is the default port where splunkweb is running. It has nothing to do with DBConnect. But of course you'll have to allow inbound traffic to the Splunk server on that port for users connecting with their browsers.

Port 8089 is used by various splunk instances (forwarders, indexers, search heads etc)to talk to each other (deployment traffic, distributing searches etc).

Port 9997 is commonly used for sending log traffic from forwarders to indexers.

/K

[gfuente]

Hello

You only need the 3306, as long as you don't install a forwarder in the db server.

regards

[sowings]

The indexer would initiate a connection from its side to the MySQL database, on whatever port the database is running. In your case, that's 3306.

Have you tried this and encountered an issue?