FYI, the "palace-6" label appearing around the place comes from /etc/services where that's the protocol your OS supplier thinks uses port 9997. If you want you can edit /etc/services and change the name to splunk-f or something similar as I'm yet to see anything that is looking for the palace-6 name on my systems. This will fix any program using the C library getservbyport entry point, so netstat, tcpdump, lsof and so on. N.B. this edit may get overwritten on an OS update in the future.
... View more