This is a diagram of Splunk components and network ports that are commonly used in a Splunk Enterprise environment. Firewall rules often need to be updated to allow communication on ports 8000, 8089, 9997, 8080 and 514.
Ports
Open required ports (adjust based on your deployment):
sudo firewall-cmd --permanent --add-port=8000/tcp # Splunk Web
sudo firewall-cmd --permanent --add-port=8089/tcp # Management port
sudo firewall-cmd --permanent --add-port=9997/tcp # Forwarder data ingestion
sudo firewall-cmd --reload
