Splunk Enterprise

Internal communications on Splunk server(Indexer, Search Head)- Can anyone explain when this happens?

Path Finder

Hello Splunkers!!

We got some issues with internal communications, and wondering about the cause of those internal communications and if this is normal (not an error), can anyone explain when this internal communication happens? 


Internal Communications: 
( =>, =>, => ( =>

Thank you for the work that will be provided.

0 Karma


Splunk's management port is 8089, but there should be no communications originating from that port.

Port 25 is for SMTP.  Again, sessions will not originate from that port.  Splunk should only connect to port 25 to send alerts or as a result of a sendemail command.

The comms between and could be anything and may have nothing to do with Splunk.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...