Splunk® Data Stream Processor

Install and administer the Data Stream Processor

Acrobat logo Download manual as PDF


On April 3, 2023, Splunk Data Stream Processor reached its end of sale, and will reach its end of life on February 28, 2025. If you are an existing DSP customer, please reach out to your account team for more information.

All DSP releases prior to DSP 1.4.0 use Gravity, a Kubernetes orchestrator, which has been announced end-of-life. We have replaced Gravity with an alternative component in DSP 1.4.0. Therefore, we will no longer provide support for versions of DSP prior to DSP 1.4.0 after July 1, 2023. We advise all of our customers to upgrade to DSP 1.4.0 in order to continue to receive full product support from Splunk.
Acrobat logo Download topic as PDF

Port configuration requirements

The Splunk Data Stream Processor uses the following ports.

Cluster Ports

These ports are used for cluster operation and should be open between cluster nodes.

Port Protocol Description
53 TCP and UDP Internal cluster DNS
2379, 2380 HTTPS Etcd server communications
4789 UDP Overlay network
6000 HTTPS Containerd registry
6443 HTTPS Kubernetes API Server
7498, 9091, 9099 TCP Calico agents
9100 HTTPS Prometheus Metrics exporter
9443 TCP k0s API
10248 - 10250, 10256, 10257, 10259 HTTPS Kubernetes components
38350 TCP Containerd

External Ports

Starting in DSP 1.4.0, all external HTTP-based traffic goes to the standard port 443. The following are ports used by end users outside of the cluster. Not all cluster nodes need to be exposed, but the node externally accessible needs to have the following ports open.

Port Description
443 Standard port for all HTTP-based traffic.
9997 Optional. Standard port used by the Splunk Forwarder service to send data from a Splunk forwarder to a data pipeline.
Last modified on 19 December, 2022
PREVIOUS
Hardware and Software Requirements
  NEXT
Network Encryption Policy

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.4.0, 1.4.1, 1.4.2, 1.4.3


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters