Splunk Default Ports (Comprehensive List)

Splunk Default Ports: What are they? This article will go through the default ports for Splunk Enterprise, Splunk Cloud, and a few other Splunk products.

What is a Port in Splunk?

In Splunk, ports are communication endpoints. When processes or applications exchange information over a network, they use a port to segment the data.

In this article, we are referring specifically to Transmission Control Protocol (TCP) communications standard when we talk about ports as communication endpoints (unless we specifically refer to an alternative). 

What is a Splunk Default Port?  

A port is considered a default when the software sets it automatically, when the community uses it as a default, and when admins cannot change the port. While it may seem ridiculous, these are all the possible ways to define a default port, even though they are all very different. For clarity in this guide, we will label them below. 

• Default: In our definition, a default is when the port is set without the user specifying the port. For example, Splunk Web (on-prem) runs on port 8000 by default. The user does not choose it, but they can change it if they wish. 
• Convention: These ports are used so often that they feel like default ports. The admin sets the port and can select any other port. The “Splunk Forwarding” port of 9997 is a great example. For Splunk Enterprise, it is not a default, yet almost every environment uses it. 
• Default – Immutable: This is a caveat for default ports where the user cannot modify the port. We find these mostly in managed services such as Splunk Cloud.

Splunk Enterprise Default Ports

Splunk Cloud Default Ports 

Splunk Observability Cloud OpenTelemetry Collector Default Ports

Splunk SOAR Default Ports for Clustered Deployments – On-Prem 

Disclaimer: These ports are current as of January 2023. Most of these ports have been static through the years but expect more ports to support new services and offerings. 

Primary Sources Used and Cited: 

Splunk Enterprise Installation Manual: https://docs.splunk.com/Documentation/Splunk/latest/Installation/Whatsinthismanual 

Securing Splunk Enterprise: https://docs.splunk.com/Documentation/Splunk/latest/Security/WhatyoucansecurewithSplunk 

Securing Splunk Cloud Platform: https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/WhatyoucansecurewithSplunk 

Getting Started with the Splunk Distribution of OpenTelemetry Collector: https://docs.splunk.com/Observability/gdi/opentelemetry/exposed-endpoints.html 

Install and Upgrade Splunk SOAR (on-premises): https://docs.splunk.com/Documentation/SOARonprem/latest/Install/Ports

If you found this helpful… 

You don’t have to master Splunk by yourself in order to get the most value out of it. Small, day-to-day optimizations of your environment can make all the difference in how you understand and use the data in your Splunk environment to manage all the work on your plate.

Cue Atlas Assessment: Instantly see where your Splunk environment is excelling and opportunities for improvement. From download to results, the whole process takes less than 30 minutes using the button below: