Splunk online course

Set Up a Splunk Receiver for Forwarded Data

Learn how to configure a Splunk indexer or intermediate forwarder to receive forwarded data, open the correct TCP port, connect forwarders, and troubleshoot delivery.

A receiver is a Splunk instance configured to listen for and accept data sent by another Splunk component. A forwarder collects or relays data from a remote host and sends it to a receiver. Remote log collection requires both sides: a sending forwarder and a receiving Splunk endpoint.

The receiver is commonly an indexer, which stores, indexes, and searches event data. It can also be an intermediate forwarder, which receives data from other forwarders and sends it onward to central indexers.

How receivers and forwarders work

A Universal Forwarder is a lightweight Splunk component commonly installed on servers and workstations. It monitors configured inputs, such as files or Windows Event Logs, and sends the resulting events to another Splunk instance. A full Splunk Enterprise instance can also act as a forwarder when it is configured to relay data.

A normal data path looks like this:

Remote log source
    -> monitored input on a forwarder
    -> receiver
    -> indexer or onward forwarding destination

For background on deploying and using forwarders, see What Are Forwarders and Monitor Logs Using Forwarders.

Requirements before enabling receiving

• Access to Splunk Web with an administrative account. Splunk Web is the browser-based administration interface.
• A running Splunk Enterprise instance intended to receive forwarded traffic.
• Network reachability from each sending forwarder to the receiver.
• A TCP port selected for forwarded data and firewall rules that permit the required traffic.
• A data-routing plan: decide whether the receiver will index the data locally or forward it to another Splunk tier.
• Installed and configured forwarders on the remote systems that contain the logs.

Before changing the receiver, identify the stable hostname or IP address that forwarders will use. In production, DNS or another stable addressing method is usually preferable to an address that may change.

Configure a receiver in Splunk Web

Complete the receiver configuration before configuring remote forwarders. The menu names can vary slightly between Splunk releases, but the workflow is the same.

1. Sign in to Splunk Web as an administrator.
2. Open Settings.
3. Select Forwarding and Receiving.
4. In the Receive data section, choose the option to add a new receiving port, often labeled Add new.
5. Enter the TCP port on which this Splunk instance should listen.
6. Save or apply the configuration.
7. Return to the receiving-port list and confirm that the selected port appears as configured.

The commonly used receiving port is TCP 9997. It is a convention for Splunk-to-Splunk forwarded data, not a requirement. Select another TCP port when organizational standards, an existing service, or network design requires it.

Understand receiver port selection

A receiving port is a data-plane listener. It is different from the port used to open Splunk Web in a browser and from other Splunk service or management ports. Choosing a different port does not remove the need to configure the corresponding forwarder destinations and firewall rules.

Apply configuration changes and verify the listener

After saving the receiving-port configuration, check the service state. Some Splunk releases or deployment conditions apply the listener immediately; others may require a Splunk restart before the listener becomes active. Follow your change-control process before restarting a production instance.

1. Confirm that the receiving port appears in Settings > Forwarding and Receiving.
2. Restart Splunk if the port is configured but the listener is not active and the environment permits a restart.
3. Confirm that the Splunk service returns to a healthy running state.
4. Verify at the operating-system or network level that the instance is listening on the selected TCP port.
5. Check Splunk logs if the service does not start or the listener fails to bind.

The exact operating-system command depends on the platform. Use the host's local socket-listing tool to check for a listening TCP endpoint and filter for the selected port. If the port is already used by another process, choose an approved alternative or stop the conflicting service according to your operational procedures.

Connect forwarders to the receiver

Once the receiver is ready, configure each remote forwarder with an output destination. The destination must contain the receiver's stable hostname or IP address and the receiver's listening port.

Forwarder destination: receiver.example.com
Forwarder destination port: 9997

The example uses port 9997. Replace it with the port selected on your receiver. Do not configure a forwarder with the Splunk Web port or another management port unless that port was explicitly configured as the forwarded-data listener.

For a single-indexer design, the path might be:

1. Enable TCP 9997 on the indexer.
2. Install Universal Forwarders on the remote Windows servers.
3. Configure each forwarder to send to the indexer's DNS name on TCP 9997.
4. Configure the desired Windows Event Log inputs and index routing.
5. Search the intended index for newly received events.

For a branch-office design, the path might instead be:

1. Enable a receiving port on an intermediate forwarder.
2. Point branch-host forwarders to that intermediate forwarder.
3. Configure the intermediate forwarder to relay data to central indexers.
4. Validate the connection and event flow at both forwarding stages.

See Configure a Splunk Forwarder on Linux, Install a Splunk Forwarder on Windows, and Monitor Remote Windows Event Logs for related forwarder tasks.

Firewall and security considerations

• Permit inbound TCP access to the receiving port on the receiver's host firewall.
• Permit the same traffic through network firewalls, security groups, and other network controls.
• Restrict inbound access to approved forwarder hosts or source networks instead of exposing the port broadly.
• Confirm that outbound traffic from each forwarder is allowed.
• Use DNS or another stable addressing method for production destinations, and keep the destination consistent across forwarders.
• When secured transport is required, use TLS or certificate-based forwarding according to your Splunk security design.

Firewall access alone does not authenticate a sender or guarantee that the data is routed correctly. Treat transport security, source restrictions, certificate management, and index permissions as separate parts of the design.

Receiver setup verification checklist

Search for received events

After the forwarder is connected and its inputs are enabled, search for recent events in the expected index. Start with a broad time range and the intended source or host, then narrow the search after confirming that data arrives.

index=<target_index> host=<remote_host>

Replace the angle-bracketed values with your actual index and host. If you do not know the final index, first confirm the routing configuration and search a sufficiently broad set of indexes that your account is allowed to view. A successful network connection does not prove that the desired input is enabled or that events are being routed to the expected index.

Troubleshoot receiver connectivity

The forwarder cannot connect

• Confirm that the receiving port is enabled in Splunk Web.
• Compare the forwarder's destination hostname or IP address and port with the receiver configuration.
• Test network reachability from the forwarding host.
• Check host firewalls, network firewalls, and security groups.
• Confirm that the Splunk service is running and that the listener has started.
• Review Splunk logs on the receiver and forwarder for connection or configuration errors.

The port is configured but is not listening

• Determine whether the Splunk release or deployment requires a restart.
• Check whether another process already uses the selected TCP port.
• Confirm that the Splunk service completed its startup successfully.
• Review diagnostic and Splunk service logs for a bind failure or invalid configuration.

The forwarder is connected but events are missing

• Confirm that the forwarder has an enabled input for the desired files, event channels, or other data source.
• Check whether events are being routed to an unexpected index.
• Search with a broader time range and verify that your permissions include the target index.
• Review forwarder and receiver logs.
• If an intermediate forwarder is involved, validate both the first and second forwarding stages.

Only some hosts can send data

• Compare destination settings across working and failing forwarders.
• Validate DNS resolution and network paths from each affected network.
• Review firewall rules for incomplete source-address restrictions.
• Check whether the affected forwarder services are running and their inputs are enabled.

Exam-relevant notes

• A receiver is the Splunk endpoint that accepts forwarded data; a forwarder is the component that sends or relays it.
• An indexer can receive forwarded data, and an intermediate forwarder can also be configured as a receiver.
• TCP 9997 is the commonly used Splunk forwarding receiver port.
• The forwarder's destination address and port must match the receiver's configured listener.
• Enabling a receiver does not create data by itself; a forwarder input and output destination are also required.
• Always distinguish the forwarding receiver port from Splunk Web, management, and other service ports.

For related administration tasks, see Create an Index, Add Data to Splunk, and Secure Splunk Forwarding with TLS where available in your course materials.