Getting Data In

How to send data to indexer and pulling config data from deployment server using forwarder ports?

brdr
Contributor

We will be installing the forwarder onto our domain controllers in DMZ.

Question, can we hardwire a port on the DC where the forwarder is installed to connect to :

  1. deployment server on 8089
  2. indexers on 9997
0 Karma

Heff
Splunk Employee
Splunk Employee

Yes,

When you install the forwarder just specify the DS server & Port like this:

msiexec.exe /i Splunk.msi DEPLOYMENT_SERVER=host:port /quiet

Then you should create an outputs App on your DS that will push just an outputs.conf to all your Forwarders.

Make sense?
http://docs.splunk.com/Documentation/Splunk/6.5.0/Installation/InstallonWindowsviathecommandline

0 Karma

brdr
Contributor

makes sense. however, if I want to lock down a port on the forwarder sitting in DMZ to use a port to communicate to 8089 on deployment server and to communicate to 9997 on indexers how do I do that? Where do I specify the port on the forwarder to communicate to DS and IDX?

0 Karma

Heff
Splunk Employee
Splunk Employee

the deploymentclient.conf will have the server:port in it and the outputs.conf will have the indexer server:port in it too. Additionally the indexer and DS are only listening on those same ports.

http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Deploymentclientconf
http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Outputsconf

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...