Port 9997Splunk Indexer Receiving

Splunk indexers use TCP 9997 by default to receive data from forwarders.

transport: tcp
in transit: cleartext
assignment: unofficial
risk: 6/10
lookups: 0

Technical Details

what runs on :9997

This is Splunk's proprietary forwarder-to-indexer protocol over TCP. A forwarder connects to the configured receiving port and sends event data using Splunk's persistent streaming protocol; the port is configurable, but 9997 is the standard default. TLS can be enabled for the forwarding connection, while Splunk's management interface commonly uses TCP 8089 and HTTP Event Collector commonly uses TCP 8088.

Security Information

exposure of :9997

risk score

6/ 10risk

treat as sensitive. widely scanned and regularly exploited when reachable — restrict it to known sources.

security averages 3.1 across 342 ports — this one sits 2.9 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

unofficial

used by convention, not registered — what answers here varies by deployment

reachable over

tcp

every listening transport is another surface to filter at the edge

security overview

This listener should not be exposed directly to the public internet. An exposed receiver can permit unauthorized log or event injection where access controls are insufficient, consume indexer resources, and expose or enable interception of sensitive telemetry if TLS is not configured; restrict sources and enable certificate-based TLS where appropriate.

Record

iana registry entry

port: :9997
service: Splunk Indexer Receiving
transport: TCP
encryption: cleartext
assignment: convention only
risk: 6/10risk
category: Security System
usage: Splunk indexers listen on TCP 9997 for connections from Universal Forwarders and other Splunk forwarders. It carries forwarded event data to the indexer for parsing and indexing, typically within an organization's internal network.
lookups: 0rank 994
added: 2026-09-22
updated: 2026-09-22
references: Splunk documentation: Configure a receiver

Something wrong?

This record is maintained by the engineers who use port 9997. Every field on it is editable — change what's wrong, say how you know, and a reviewer publishes it, usually within a minute. Last touched 2026-09-22.

01edit any field on a page of its own
02a model checks it for accuracy and spam
03clean and confident goes live immediately

edit this record →back to the registry

Related Ports

all 342 in security →

the 8 most looked-up other ports in security — 342 ports carry that label.

port	service	proto	category	risk	views
:8881	Atlasz Secure Server	TCP	Web Services	caution	67.6k
:443	HTTPS	TCPtls	Web Services	caution	65.9k
:8291	Winbox MikroTik Admin	TCP	Security	caution	62.9k
:3268	Microsoft Global Catalog (GC)	TCPUDP	Security	caution	54.6k
:135	Microsoft EPMAP	TCPUDP	Security	caution	51.9k
:3128	Squid Proxy HTTP	TCP	Web Services	caution	45.8k
:8080	HTTP Alternate	TCPtls	Web Services	caution	44.9k
:7000	Vuze HTTPS Tracker	TCPtls	Security	caution	28.9k

risk mix of the 8 listed

caution100%

3 of 8 encrypted

Port :9997Splunk Indexer Receiving

Technical Details

Security Information

Related Ports

Port 9997Splunk Indexer Receiving