topic Re: change universal forwarder 4.2 mgmt port in Getting Data In

change universal forwarder 4.2 mgmt port

deyeo — Mon, 18 Apr 2011 08:23:57 GMT

How do i change the 4.2 universal forwarder's management port from 8089 to other ports (to prevent conflict with existing port tcp 8089 on my server).

in 4.1, we can change it in the web.conf but it does not work in 4.2 universal forwarder.

Re: change universal forwarder 4.2 mgmt port

MarioM — Mon, 18 Apr 2011 08:45:57 GMT

You can do it in command line:

splunk set splunkd-port <port number>

Re: change universal forwarder 4.2 mgmt port

deyeo — Mon, 18 Apr 2011 09:16:07 GMT

not exactly viable. because Splunk must be running in order to run the CLI command. And the moment i start & run my Splunk, the Splunk default port would have immediately conflict with existing TCP8089 (before i can even run the CLI command).

Is there a way to change the management port on the first time Splunk starts up (so that it never ever run on TCP8089)?

Re: change universal forwarder 4.2 mgmt port

MarioM — Mon, 18 Apr 2011 10:28:47 GMT

you can create or modify /splunk/etc/system/local/web.conf with the following value:

[settings]
mgmtHostPort = 127.0.0.1:8090

I tested it on mine and it's works.

Re: change universal forwarder 4.2 mgmt port

deyeo — Mon, 18 Apr 2011 10:40:27 GMT

that is strange. it does not work for me. take note that it is splunk 4.2 universal forwarder which is a separate installer (splunkforwarder-4.2-96430-xxxx) file from the usual splunk installer, and it installs by default at /opt/splunkforwarder and not the usual /opt/splunk

based on the path that you given, it does not seem that you have tested on splunk 4.2 UNIVERSAL FORWARDER

Re: change universal forwarder 4.2 mgmt port

MarioM — Mon, 18 Apr 2011 12:29:06 GMT

yes i understood it was and i tried on Universal Forwarder.
Is the folder or file permissions ok ? Did you use same syntax in your web.conf as me?

Re: change universal forwarder 4.2 mgmt port

proctorgeorge — Tue, 19 Apr 2011 16:03:38 GMT

If you are looking to change the port that the deployment client (forwarder) looks for on the deployment server to receive its configurations from, then it is set at *\SplunkUniversalForwarder\etc\system\local in deploymentclient.conf which looks like this:

[target-broker:deploymentServer]
targetUri = deployservername:8089

If you are looking for the port that a deployment server manages from, then use mgmtHostPort in web.conf as others have answered.

Re: change universal forwarder 4.2 mgmt port

emhimes — Wed, 08 May 2013 14:34:53 GMT

Thanks - this helped me figure out how to get forwarding working again after a LAN IP migration. I had to dive into an existing Splunk server configuration w/ no documentation by the guy who set it up.