Error message on Splunk

[hordoffa1970]

Encountered the following error while trying to save: Failed to create. Configuration for port 9997 already exists. I am getting this message on Splunk when I try to configure and save the listening port

[kknairr]

@hordoffa1970 The error message “Failed to create. Configuration for port 9997 already exists” means the receiving port you’re trying to configure is already set up somewhere in your Splunk configuration. Port 9997 is the default receiving port for Splunk indexers, so if it’s already enabled, trying to add it again will trigger this message.

You can check existing receiving configuration In Splunk Web by navigating to: 
Settings → Forwarding and Receiving → Configure Receiving

You should see port 9997 already listed. If 9997 is already active, you don’t need to add it again. Just confirm it’s listening.

> Giving Karma & Marking the answer helps others find solutions faster!

[livehybrid]

Hi @hordoffa1970 

As the error suggests, it looks like something is already listening on port 9997. 

What exactly is it you are trying to do? Do you already have an inputs.conf configured to receive data (or is something else on your system using port 9997)?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing