I was getting the same error message when I tried to ingest data from CheckPoint LogExporter Log Server to Intermediate Heavy Forwarder. I tried to use port numbers below 1024 and 9997. It is not mentioned anywhere in the documentation that you can't use these ports to ingest data from LogExporter to Splunk. It turned-out that you can't use port numbers below 1024 if you are not running as "root" or "root privileges". You can't also use port 9997, because it's reserved for "cooked" data ingestion from Splunk Forwarder to indexer or heavy forwarder. In the end, I chose port 18188 and it worked. I hope that this info helps someone who runs into the same problem as I did. ... View more