Getting Data In

What port splunk universal forwarder use to sent data to the indexer on splunk instance?

royimad
Builder

What is the port that splunk universal forwareder use to sent data to the indexer on a splunk instance, what protocol need to exist between universal forwarder and the splunk instance?

Tags (1)
0 Karma
1 Solution

datasearchninja
Communicator

It is whatever you set it to. The port in outputs.conf on the forwarder needs to match the port in inputs.conf on the indexer

See the doco

View solution in original post

0 Karma

stefano_guidoba
Communicator

By default, it's port 9997. Please refer to Splunk Docs to obtain further information on this topic. And remember you can change receiving/admin ports as you please (for example, in case of 2 splunk installations on the same host).

Splunk Docs

Regards,
Stefano

0 Karma

datasearchninja
Communicator

It is whatever you set it to. The port in outputs.conf on the forwarder needs to match the port in inputs.conf on the indexer

See the doco

0 Karma

Ayn
Legend

If a port on the system is already used by an application then by definition it is not available to be used by other applications.

royimad
Builder

Just to confirm more your answer - Can i use an existing port used and opened?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...