VMware ESXi and vSphere Cluster Management

Configure a Splunk Receiver for Remote Log Collection

Learn how to enable a Splunk receiver, add TCP port 9997, configure remote forwarders, and validate forwarded event delivery.

A Splunk receiver is a Splunk instance or configured Splunk component that listens for and accepts event data sent by remote forwarders. It is the destination-side component in a forwarding pipeline.

Remote log collection requires both sides of the connection: a forwarder on the source host and a receiver on the destination. The receiver must have a listening TCP port enabled before a forwarder can send data to it.

Prerequisites

• Basic familiarity with Splunk data ingestion.
• Access to Splunk Web with administrative permissions.
• Knowledge of the receiver hostname or IP address.
• Basic understanding of TCP ports, hostnames, IP addresses, and firewall reachability.
• A Splunk forwarder installed or configured on the remote source host.

Receiver and Forwarder Roles

A forwarder is a Splunk component that collects data from a host or another source and transmits that data to a receiver. A receiver listens for incoming forwarded data and accepts it.

An indexer can act as a receiver. A forwarder can also be configured to accept data from other forwarders when an intermediate forwarding design is needed. The receiver function describes how a component accepts data; it does not by itself describe every role that component performs. For example, an indexer may receive, index, and make events available for search, while an intermediate forwarder may receive and forward data onward.

How the Forwarding Pipeline Works

1. A remote host produces logs or other machine data.
2. A forwarder on that host collects the data.
3. The forwarder is configured with the receiver hostname or IP address and receiving TCP port.
4. The receiver listens on that port and accepts the forwarded connection.
5. The receiving Splunk deployment processes the events, commonly through an indexer that indexes them for search.

The destination must be configured first. Enabling a receiving port does not automatically configure remote senders; each forwarder still needs the receiver address and the same port number.

Open the Forwarding and Receiving Settings

Use Splunk Web, the browser-based Splunk administration interface, to add the receiving port.

1. Sign in to Splunk Web with an account that has administrative permissions.
2. Open Settings.
3. Open Forwarding and Receiving.
4. Locate the receiving-data section.
5. Choose the option to add a new receiving port.

The exact wording or page layout can vary between Splunk releases, but the receiving-data area is the place to create inbound listening ports.

Add a TCP Receiving Port

A receiving port is a TCP listening port configured on the receiver for inbound data from forwarders. TCP port 9997 is the conventional example for Splunk-to-Splunk forwarding traffic.

1. In the receiving-data section, choose to add a new port.
2. Enter 9997 as the port number.
3. Apply or save the configuration.
4. Confirm that the new port appears in the receiving-port list.

Use another port only when your design requires it. The selected port must be available on the receiver and reachable from every system running a forwarder that will send data to it. Network firewalls, host firewalls, security groups, and routing rules must allow the required TCP traffic.

Example receiver setting
Protocol: TCP
Listening port: 9997

Apply the Configuration

Splunk behavior after adding a receiving port can vary by release and deployment. Some versions or configurations activate the change immediately; others require a Splunk restart.

Follow the confirmation or restart guidance shown by your Splunk installation. Before configuring or testing remote senders, verify that the receiving service is active and that the port is still listed in Splunk Web.

Configure the Remote Forwarder

After the receiver is enabled, configure the forwarder on the remote host with:

• The receiver hostname or IP address.
• The receiver's listening TCP port.
• The appropriate forwarding settings for the data source.

For the standard example, the destination is the central Splunk instance at port 9997. The sender and receiver must use the same port value.

Forwarder destination
Receiver host: central-splunk.example.internal
Receiver port: 9997

The hostname above is an example value, not a required address. Replace it with the real hostname or IP address of your receiver.

Example: One Remote Host and One Central Indexer

Suppose a remote machine runs a Splunk forwarder and a central Splunk indexer is designated as the receiver.

1. Sign in to the central indexer through Splunk Web.
2. Open Settings, then Forwarding and Receiving.
3. In the receiving-data section, add TCP port 9997.
4. Apply the configuration and restart Splunk if the installed release requires it.
5. On the remote host, set the forwarder's destination to the central indexer's hostname or IP address and port 9997.
6. Confirm network connectivity from the remote host to the central indexer on TCP port 9997.
7. Generate or wait for source events, then check the central deployment for incoming data.

Example: Intermediate Forwarding Design

Receiver capability is not limited to an indexer. In an intermediate design, one Splunk forwarder receives data from upstream forwarders and passes that data to another destination.

1. Enable a receiving port, such as 9997, on the intermediary forwarder.
2. Configure upstream forwarders to target the intermediary's hostname or IP address and port 9997.
3. Configure the intermediary to forward the collected data to the next destination.
4. Validate both connections: upstream forwarders must reach the intermediary, and the intermediary must reach its downstream destination.

This design separates the receiving function from the final indexing function. The intermediary accepts inbound data, but it may also forward that data onward rather than serving as the final search destination.

Post-Configuration Validation

Troubleshooting

The forwarder cannot connect to the receiver

• Confirm that a receiving port has been added on the destination Splunk instance.
• Confirm that the forwarder targets the correct receiver hostname or IP address.
• Confirm that the forwarder uses the receiver's configured port, such as 9997.
• Test TCP reachability from the forwarder host to the receiver host and port.
• Check host firewalls, network firewalls, security groups, and routing.
• Restart Splunk if the installed release requires a restart before the new receiving configuration becomes active.

The receiver is enabled but no events appear

• Verify that the remote host actually has a forwarder installed and configured.
• Verify that the forwarder has been pointed at the receiver.
• Compare the sender's destination port with the receiver's listening port.
• Confirm that the receiver is the intended destination and not a different host or address.
• Check the receiving Splunk deployment for incoming data after generating or waiting for new source events.

Exam-Relevant Notes

• A receiver is the destination-side listener for data sent by forwarders.
• An indexer can receive forwarded data, but receiving and indexing are separate concepts.
• A forwarder can also be configured to receive data when an intermediate forwarding tier is required.
• The receiving port must be enabled before a remote forwarder can send data to that instance.
• TCP port 9997 is the standard example for Splunk-to-Splunk forwarding traffic.
• The forwarder's destination host and port must match the receiver's reachable address and listening port.
• Adding a port may require a Splunk restart depending on the installed release.

Summary

To configure a Splunk receiver, use an administrative Splunk Web account to open Settings and Forwarding and Receiving, add a TCP receiving port such as 9997, apply the change, and restart Splunk when required. Then configure each remote forwarder with the receiver's hostname or IP address and the same TCP port. Finally, verify the configured port, network reachability, forwarder communication, and visible incoming events.

Use this receiver setup guide as the reference procedure when preparing a destination for remote log collection.