Splunk Data flow Diagram

[allamiro]

Can some one guide us or provoide us with the splunk data flow diagram

with all the port number services etc

[gkanapathy · Accepted solution]

I don't know that you need a diagram. There isn't that much. Forwarders send to the splunktcp port on the destination (which may be another forwarder, but that is dependent on your designed architecture), which is arbitrary, but conventionally we use 9997. And search heads talk to the splunkd port, which is by default on port 8089.

That's it for data flow. If you need more information, you should probably look at the appropriate sections of the documentation, http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview and http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutindexesandindexers are probably most relevant.