Splunk® Enterprise

Inherit a Splunk Enterprise Deployment

Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Components and their relationship with the network

Splunk Enterprise components require network connectivity to work properly if they have been distributed across multiple machines, and even in cases where the components are on one machine.

Splunk components communicate with each other using TCP and UDP network protocols. A firewall that has not been configured to allow these ports open can block communication between the Splunk instances.

Splunk software uses the following network ports to communicate between its components by default or by convention. You can perform a network port scan on a host to determine if it is listening on a port. Record open port numbers on your deployment diagram.

Component Purpose Communicates on Listens on
All components* Management / REST API N/A TCP/8089
Search head / Indexer Splunk Web access Any TCP/8000
Search head App Key Value Store Any TCP/8065, TCP/8191
Indexer Receiving data from forwarders N/A TCP/9997
Indexer cluster peer node / Search head cluster member Cluster replication N/A TCP/9887
Indexer/Forwarder Network input (syslog) N/A UDP/514

Diagrams

The following diagrams show the network ports that Splunk software listens on.

SplunkNetworkPorts.png SplunkNetworkPortsCluster.png

Last modified on 08 March, 2019
Examine configuration files to determine your topology   Learn about the data in your Splunk deployment

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters