splunk ports

[yongly]

Hi,

So I have a question about how splunk determines which ports to listen on and forward data on?

Here's the situation on my splunk forwarder:
1. I have splunkd running on port 9501.. since it starts with splunkd -p 9501..
2. In my outputs.conf it's set up like this:

[tcpout]
defaultGroup = SNZCLAKL118_9997
disabled = false

[tcpout:SNZCLAKL118_9997]
server = SNZCLAKL118:9997

When I do a tcpdump on those ports, it would seem that my splunk forwarder is sending data out through both those ports which is a little strange. Anyone know how splunk determines which port to send to and what data to send what port to? Just wondering how to handle the discrepancy between starting splunkd with a -p 9501 and what's in the outputs.conf file?

It's confusing since I had always thought it would just bind on port 9501 and forward all data through there.

Any insight would be appreciated.

[bandit]

http://answers.splunk.com/answers/118859/diagram-of-splunk-common-network-ports.html

[lguinn2 · Accepted solution]

Splunk can use a number of ports, for a variety of purposes. There are defaults, but you can configure the ports however you require.

splunkd port - AKA management port

This port is used for communication between splunkd and SplunkWeb (the GUI). It is also used for the REST endpoints. This port is not used for any forwarding or indexing. It is used only for command and control functions.
Bu default, this is port 8089, but a different value can be specified in web.conf

SplunkWeb port

This port is used for the GUI. This is the port that you use when pointing your browser at Splunk. This port is NEVER used for any forwarding or indexing. By default, this is port 8000, but a different value can be specified in web.conf

Note that this port is not used on Universal Forwarders, which have no GUI.

Network Inputs

You can ask Splunk to monitor a port for input, using either TCP or UDP protocol. You can use any port that is not already being used (ie, you can't use the splunkd or SplunkWeb ports). Network inputs are configured in inputs.conf, and look like this

[udp://:514]
sourcetype = syslog
connection_host = dns

For these inputs, Splunk will index the data that it receives via the port. But network inputs are not used for Splunk-to-Splunk communication like forwarding.

Forwarding and Receiving

This is the Splunk-to-Splunk communication between the forwarders and indexers. It is important the indexers are receiving on the same port that the forwarders are sending! You can use any port that you like for forwarding/receiving - if it is not already being used by something else.

On a forwarder, this port is configured in outputs.conf. Here is an example:

[tcpout]
defaultGroup = myIndexers
[tcpout:myIndexers]
server = indexer1.mycompany.com:9997,indexer2.mycompany.com:9997

On an indexer, this port is configured in inputs.conf. Here is an example:

[splunktcp://:9997]
connection_host = dns

This inputs.conf tells the indexer to listen for data from any forwarder on port 9997. The indexer will never accept incoming data on its splunkd port.

I hope this clarifies things for you.