you can disable 8089 on the UF. And if you are executing he command on the UF, then the creds are what you used for installation or the default ones if you havent changed (admin/changeme) ... View more

add 8089 in the same way and it should work as well. if it does. confirm the answer. thanks! ... View more

I believe its just the uptable. You should add the output connection for dst port 8089 from your server and try. you did it in reverse previously. ... View more

If it says connection refused, then port 9997 is not open on your indexer, or there is not splunk service listening on port 9997. ... View more

@user789 So, let me give you some more information to what I think. Each UF is also a splunk installation. It will have a management port 8089 running. That is only used when you try connecting to the UF remotely and perform splunk commands. You can disable the management port on the UF, no one cares. Secondly, are you referring to the Forwarder Management on the Deployment Server? If this is the place you are not seeing your UF, then, just enable iptables rule for OUTPUT from your UF ( ANY to ANY ) on port 8089/TCP. This will make the UF to be able to pass the communication to the DS. And the DS listens on port 8089 which is the DS's management port. And thirdly, Have you given the DS info? You can do this via an app in etc\apps\customname\local\deployment.conf If you have done all the above and splunk service is running you should see the UF as long as your DS is also accepting 8089 Communications. And if you see it on the DS and data is not coming to your indexer, let us know. ... View more

I believe you gave it in the reverse. Try OUTPUT dport 8089 and restart splunk ... View more