ports for communication at indexer ,heavy forwarder

[kteng2024]

Hi There,

Can i please know the ports to be opened for heavy forwarder , indexer , universal forwarder ?

[esix_splunk]

I think you want to take a look at this post : https://answers.splunk.com/answers/58888/what-are-the-ports-that-i-need-to-open.html

It has an excellent diagram and listing of all the ports required for traffic flows.

[kteng2024]

Thank you for the reply.. But it seems like HF is using port 9997 to communicate to indexers and 8089 for deployment server . I thought different ports for heavy forwarders .

[esix_splunk]

TCP/8089 is the default management port used by Splunk for communicating with other Splunk instances (And REST API.)
Port 9997 is not a default port, but in the examples this is the SPlunkTCP Input port on the indexers that takes Splunk Cooked data from a HF. (So the UF/HF sends to TCP/9997 on the indexers.)

All of these ports can be changed via the configuration files.