Splunk Dev

Which port do we use to forward data from a HF to indexer, when we already have multiple UF sending logs to HF on port 9997?

Akhilprakash
New Member

UFs ---9997---> HF --- 9997---> Indexers

We have above structured architecture, where multiple UF will send logs to HF and HF will forward those logs to Indexer.
HF is configured to receive logs from UF on port 9997, Now which port I have to use to forward data from HF to indexer?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Your configuration is just fine as-is, assuming you are sticking with the defaults.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Your configuration is just fine as-is, assuming you are sticking with the defaults.

0 Karma

Akhilprakash
New Member

Sticking with the defaults as we are receiving and sending on port 9997 from HF. But will there be any conflict when both receiving and sending happens on the same port?

0 Karma

FrankVl
Ultra Champion

The HF won't be sending from 9997, it will send from some random port, to port 9997 on the Indexers. Network traffic doesn't travel 'on' a port, it travels from a source port to a destination port.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...