Splunk® Data Stream Processor

Install and administer the Data Stream Processor

Acrobat logo Download manual as PDF


On April 3, 2023, Splunk Data Stream Processor will reach its end of sale, and will reach its end of life on February 28, 2025. If you are an existing DSP customer, please reach out to your account team for more information.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Port configuration requirements

The Splunk Data Stream Processor needs the following ports open on Gravity.

Installer Ports

These ports are required during initial installation and can be closed after installation is complete.

Port Protocol Description
61009 HTTPS Install wizard UI access
61008-61010, 61022-61024 HTTPS Installer agent ports
4242 TCP Bandwidth checker utility
N/A ICMP ICMP is required between all DSP nodes for installer health checks.

Cluster Ports

These ports are used for Cluster operation and should be open between cluster nodes.

Port Protocol Description
53 TCP and UDP Internal cluster DNS
8472 VXLAN (UDP encapsulation) Overlay network
7496, 7373 TCP Serf (Health check agents) peer to peer
7575 TCP Cluster status gRPC API
2379, 2380, 4001, 7001 HTTPS Etcd server communications
6443 HTTPS Kubernetes API Server
30000 - 32767 HTTPS Kubernetes internal services range
10248 - 10250, 10255 HTTPS Kubernetes components
5000 HTTPS Docker registry
3022-3025 SSH Teleport internal SSH control panel
3080 HTTPS Teleport Web UI
3008-3012 HTTPS Internal Gravity services
32009 HTTPS Gravity Cluster & Hub Control Panel UI
3012 HTTPS Gravity RPC agent

External Ports

The following are ports used by end users outside of the cluster. Not all cluster nodes need to be exposed, but the node externally accessible needs to have the following ports open.

Port Description
30000 DSP UI. The port used to host the Splunk Data Stream Processor UI.
31000 API Gateway. The port used to connect to the Splunk Data Stream Processor API Services.
30002 Authentication. The port used to authenticate and login to the Splunk Data Stream Processor UI.
30001 Optional. Used by the Splunk Forwarder service to send data from a Splunk forwarder to a data pipeline.

Firewalld

If firewalld is enabled in the system, Kubernetes services may not be able to communicate under default configuration. See the Gravitational documentation about firewalld.

IPv4 Forwarding

IPv4 forwarding on servers is required for internal Kubernetes load balancing and must be enabled for all nodes. For more information, see IPv4 Forwarding in the Gravity documentation.

Last modified on 24 April, 2020
PREVIOUS
Install the Data Stream Processor
  NEXT
Licensing for the Splunk Data Stream Processor

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.0.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters