Splunk opens 9997 port

1: Configuration today search head Of outputs.conf When you file , Found an error ： say port ：9997 Not open .

I logged in to indexer above , I found that it didn't open , Read some information , It is found that if it is a single machine instance Words , Go to setting -> Forwarding and Recieveing It can be in receiving It set up 9997 port.

After setting up , You will find ： The following files are generated ：inputs.conf

[splunktcp://:9997]
disabled=false

2: Because of my splunk yes cluster Environment , First check the old indexer Environmental Science ：

splunk cmd btool inputs list splunktcp --debug

Found in a app below ：

/opt/splunk/etc/slave-apps/XXXX/default/inputs.conf [splunktcp://:9997]

Cause finding , It turns out that this one is not equipped in the new environment

3: resolvent ：

Go to cluster master server above ： /opt/splunk/etc/master-apps/XXXXX/default. Edit the file below ：

cat inputs.conf

[splunktcp://:9997]
disabled=false

4: stay cluster master It's published on ： splunk apply cluster-bundle. Found in indexer 9997 port already open.