Port configuration requirements

The Splunk Data Stream Processor uses the following ports.

Cluster Ports

These ports are used for cluster operation and should be open between cluster nodes.

Port	Protocol	Description
53	TCP and UDP	Internal cluster DNS
2379, 2380	HTTPS	Etcd server communications
4789	UDP	Overlay network
6000	HTTPS	Containerd registry
6443	HTTPS	Kubernetes API Server
7498, 9091, 9099	TCP	Calico agents
9100	HTTPS	Prometheus Metrics exporter
9443	TCP	k0s API
10248 - 10250, 10256, 10257, 10259	HTTPS	Kubernetes components
38350	TCP	Containerd

External Ports

Starting in DSP 1.4.0, all external HTTP-based traffic goes to the standard port 443. The following are ports used by end users outside of the cluster. Not all cluster nodes need to be exposed, but the node externally accessible needs to have the following ports open.

Port	Description
443	Standard port for all HTTP-based traffic.
9997	Optional. Standard port used by the Splunk Forwarder service to send data from a Splunk forwarder to a data pipeline.