Port configuration requirements

The Splunk Data Stream Processor uses the following ports.

Installer Ports

These ports are required during initial installation and can be closed after installation is complete.

Port	Protocol	Description
61009	HTTPS	Install wizard UI access
61008-61010, 61022-61024	HTTPS	Installer agent ports
4242	TCP	Bandwidth checker utility

Cluster Ports

These ports are used for Cluster operation and should be open between cluster nodes.

Port	Protocol	Description
53	TCP and UDP	Internal cluster DNS
8472	VXLAN (UDP encapsulation)	Overlay network
7496, 7373	TCP	Serf (Health check agents) peer to peer
7575	TCP	Cluster status gRPC API
2379, 2380, 4001, 7001	HTTPS	Etcd server communications
6443	HTTPS	Kubernetes API Server
30000 - 32767	HTTPS	Kubernetes internal services range
10248 - 10250, 10255	HTTPS	Kubernetes components
5000	HTTPS	Docker registry
3022-3025	SSH	Teleport internal SSH control panel
3080	HTTPS	Teleport Web UI
3008-3012	HTTPS	Internal Gravity services
32009	HTTPS	Gravity Cluster & Hub Control Panel UI
3012	HTTPS	Gravity RPC agent
9100	HTTPS	Prometheus Metrics exporter

External Ports

The following are ports used by end users outside of the cluster. Not all cluster nodes need to be exposed, but the node externally accessible needs to have the following ports open.

You must open the 30000, 31000, and the 30002 ports to use DSP. The 30001 port is only required if you are planning to send data from a Splunk forwarder to DSP.

Port	Description
30000	DSP UI. The port used to host the Splunk Data Stream Processor UI.
31000	API Gateway. The port used to connect to the Splunk Data Stream Processor API Services, including Collect, Forwarder, Identity, Ingest, Streams, and DSP HEC.
30002	Authentication. The port used to authenticate and login to the Splunk Data Stream Processor UI.
30001	Optional. Used by the Splunk Forwarder service to send data from a Splunk forwarder to a data pipeline.