topic Re: How do I find out what port Splunk is running on? in Security

How do I find out what port Splunk is running on?

Simeon — Sat, 01 May 2010 00:46:27 GMT

I have installed Splunk multiple times on my machine and I am trying to figure out what ports I have configured. Is there a way to see what ports Splunk is running on?

Re: How do I find out what port Splunk is running on?

Simeon — Sat, 01 May 2010 00:49:49 GMT

There are three ways to verify the ports that are configured for Splunk. By default, Splunk will run on port 8000 for the web services and port 8089 for splunkd services.

Check the $SPLUNK_HOME/etc/system/local/web.conf for port settings:

mgmtHostPort = 127.0.0.1:8089
httpport = 8000
Run the following command:

./splunk show web-port

./splunk show splunkd-port
Use the btool command to see web.conf settings:

./splunk cmd btool web list --debug

Re: How do I find out what port Splunk is running on?

Ledio_Ago — Thu, 06 May 2010 23:11:44 GMT

By the way, when installing Splunk on Windows, if the default ports (8000, 8089) are taken, Splunk will automatically bind to the next available port.

Re: How do I find out what port Splunk is running on?

kinjalmistry — Tue, 24 Aug 2021 16:27:23 GMT

Is there any way to find out the port on which Splunk is set up programmatically using Splunk Java SDK? Basically to read the entry from $SPLUNK_HOME/etc/system/local/web.conf?

Re: How do I find out what port Splunk is running on?

s2_splunk — Tue, 24 Aug 2021 17:44:32 GMT

This would have been better asked in a new question instead of as a reply to an 11 year old one... 😉

You can use a REST API call to get that info programmatically, here's a search example:

| rest /services/server/settings | fields *Port *port

The Java SDK has a class named "Settings" with methods to retrieve host and port values, among other settings.

Re: How do I find out what port Splunk is running on?

rutherglen — Sun, 02 Jul 2023 16:58:57 GMT

Under what directory do we run ./splunk show web-port please? I tried it under /Applications/Splunk, it didn't work.

Re: How do I find out what port Splunk is running on?

inventsekar — Mon, 03 Jul 2023 01:14:54 GMT

Hi @rutherglen
I tried it under /Applications/Splunk, it didn't work.

I understand you are on linux.. so splunk is mostly installed on /opt/splunk and the splunk executable file is present at /opt/splunk/bin/splunk.

so you should run the above command like this:

/opt/splunk/bin/splunk show web-port

for windows users...

c:\Program Files\Splunk\bin>.\splunk show web-port
WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details.
Splunk username: admin
Password:
Web port: 8000

c:\Program Files\Splunk\bin>

Best Regards, Sekar

For Splunk newbies alone, I have created a youtube channel.. pls check it out - https://www.youtube.com/@SplunkNewbies101/videos

Re: How do I find out what port Splunk is running on?

rutherglen — Mon, 03 Jul 2023 02:33:32 GMT

Well, I am using Mac. So I tried this cmd: /Applications/Splunk/bin/splunk show web-port

I said yes to the agreement, and I get these error msg's:

subprocess.CalledProcessError: Command '['/Applications/Splunk/bin/splunkd', 'local-rest-uri', '-p', '8089']' died with <Signals.SIGABRT: 6>.

The second error msg is:

During handling of the above exception, another exception occurred:

splunk.clilib.control_exceptions.ConfigError: ("Unable to retrieve splunkd management port using '/Applications/Splunk/bin/splunkd local-rest-uri -p 8089': ",)

Google is not much help. Thanks a lot for your help so far.

Re: How do I find out what port Splunk is running on?

inventsekar — Mon, 03 Jul 2023 02:45:40 GMT

i hope this one ur personal splunk i think..(on production splunk we should not face such issues actually;) )

the error looks strange actually.. we need more details... is splunk GUI working fine or not..

is data onboarding working fine or not.. approx how long u r facing this issue..

if this is ur personal splunk instance, then, maybe, the simple solution is to uninstall and resinstall..

Re: How do I find out what port Splunk is running on?

rutherglen — Mon, 03 Jul 2023 02:53:15 GMT

Yeah, it's my personal Splunk. I'm taking a training and trying to follow along. I'm using an old Mac, 10.12 or 13, I think. Splunk prob doesn't support lower than 10.14. But it says it's installed successfully and I have an icon on my desktop. It self-installed and i never had to select ports, it seems something went wrong with port assignment. Thanks.

Re: How do I find out what port Splunk is running on?

isoutamo — Tue, 04 Jul 2023 17:15:38 GMT

You could run Splunk 8.0.10 on macOS 10.13 and probably 7.2.x on macOS 10.12? https://www.splunk.com/en_us/download/previous-releases.html seems to have at least 8.1.x and 7.1.9 versions for free download.

At least some newer versions can installed into old macOS versions, but it's not sure that those are running without issues on these.

r. Ismo

Re: How do I find out what port Splunk is running on?

rutherglen — Thu, 06 Jul 2023 14:03:09 GMT

I didn't have a web.conf at step one of your instructions, so I made it with the K/V pair, my Splunk still didn't work.

I ran the two cmds(one by one), a license agreement came up instead of the results of the cmds, I typed y, and the original error msg came up again, Unable to retrieve splunkd management port using '/Applications/Splunk/bin/splunkd local-rest-uri -p 8089'

Re: How do I find out what port Splunk is running on?

tchase — Mon, 10 Jul 2023 21:40:50 GMT

You can always hit the REST API programatically. For example to find the web port you could use: curl -k -u admin:password https://localhost:8089/services/propertieb/settings/httpport

Re: How do I find out what port Splunk is running on?

tchase — Mon, 10 Jul 2023 21:42:20 GMT

Sorry the web url didn't past properly: curl-u admin:password https://localhost:8089/services/properties/web/settings/httpport

Re: How do I find out what port Splunk is running on?

vidyaEdilebert — Mon, 10 Jun 2024 22:35:41 GMT

I found it in this folder structure --> C:\Program Files\Splunk\etc\system\default\web.conf