Security

changing Indexer receiver port

Rajshekhar
New Member

We have indexer installed on windows server which is connected to many forwarders(linux servers).
Right now we are using port 9997 as receiver port in Indexer server, we have lots of data in indexer.

Now we need to change the receiver port from existing 9997 to some other port.

1)after changing the port in Splunk indexer, will I be able to search all the past data which was indexed using port 9997?

2)Will I get latest data using new port without any issues?

3)Are there any special modifications we need to do for this to work properly?
Please let me know how I can change the port without causing any issues in existing data.

Thanks|

Tags (2)
0 Karma

Takajian
Builder

I answer your question inline as bellow.

1)after changing the port in Splunk indexer, will I be able to search all the past data which was indexed using port 9997?

Yes. The past data is already stored in index server, you can search them without problem.

2)Will I get latest data using new port without any issues?
Yes, you can get data with new port. But you need to change configuration of all forwarders. If you use deployment server, you can deploy new configuration to all forwarder easily. If not, you need to change them manually.

3)Are there any special modifications we need to do for this to work properly?
Please let me know how I can change the port without causing any issues in existing data.

It does not affect existing data. Most problem I think is to change configuration of all forwarders.

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...