Splunk® Data Stream Processor

Install and administer the Data Stream Processor

Acrobat logo Download manual as PDF


On April 3, 2023, Splunk Data Stream Processor reached its end of sale, and will reach its end of life on February 28, 2025. If you are an existing DSP customer, please reach out to your account team for more information.

All DSP releases prior to DSP 1.4.0 use Gravity, a Kubernetes orchestrator, which has been announced end-of-life. We have replaced Gravity with an alternative component in DSP 1.4.0. Therefore, we will no longer provide support for versions of DSP prior to DSP 1.4.0 after July 1, 2023. We advise all of our customers to upgrade to DSP 1.4.0 in order to continue to receive full product support from Splunk.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Port configuration requirements

The Splunk Data Stream Processor uses the following ports.

Installer Ports

These ports are required during initial installation and can be closed after installation is complete.

Port Protocol Description
61009 HTTPS Install wizard UI access
61008-61010, 61022-61024 HTTPS Installer agent ports
4242 TCP Bandwidth checker utility

Cluster Ports

These ports are used for Cluster operation and should be open between cluster nodes.

Port Protocol Description
53 TCP and UDP Internal cluster DNS
8472 VXLAN (UDP encapsulation) Overlay network
7496, 7373 TCP Serf (Health check agents) peer to peer
7575 TCP Cluster status gRPC API
2379, 2380, 4001, 7001 HTTPS Etcd server communications
6443 HTTPS Kubernetes API Server
30000 - 32767 HTTPS Kubernetes internal services range
10248 - 10250, 10255 HTTPS Kubernetes components
5000 HTTPS Docker registry
3022-3025 SSH Teleport internal SSH control panel
3080 HTTPS Teleport Web UI
3008-3012 HTTPS Internal Gravity services
32009 HTTPS Gravity Cluster & Hub Control Panel UI
3012 HTTPS Gravity RPC agent
9100 HTTPS Prometheus Metrics exporter

External Ports

The following are ports used by end users outside of the cluster. Not all cluster nodes need to be exposed, but the node externally accessible needs to have the following ports open.

You must open the 30000, 31000, and the 30002 ports to use DSP. The 30001 port is only required if you are planning to send data from a Splunk forwarder to DSP.

Port Description
30000 DSP UI. The port used to host the Splunk Data Stream Processor UI.
31000 API Gateway. The port used to connect to the Splunk Data Stream Processor API Services, including Collect, Forwarder, Identity, Ingest, Streams, and DSP HEC.
30002 Authentication. The port used to authenticate and login to the Splunk Data Stream Processor UI.
30001 Optional. Used by the Splunk Forwarder service to send data from a Splunk forwarder to a data pipeline.
Last modified on 14 July, 2022
PREVIOUS
Hardware and Software Requirements
  NEXT
Network Encryption Policy

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1-patch02, 1.2.1, 1.2.2-patch02, 1.2.4, 1.2.5, 1.3.0, 1.3.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters