Archive2

How can I disable the splunk web server?

Splunk Employee
Splunk Employee

I have a Splunk instance where I do not need the web services. How can I disable the internal Splunk web server from running?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

You can do this via manager.

Login to splunkweb and click on Manager. From the Manager homepage, click on system settings, then general settings.

Under the splunk web section of that form, there are three options, one of them being the one you want.

Splunk Web Run Splunk Web Yes No

Just change Run Splunk Web to No, and submit the form, you will need to restart and after that you will no longer have a splunkweb front end running on your server.

You can also do this via the cli with: ./splunk disable webserver, then restart splunk and it disabled.

To turn this back on, you won't be able to do this via splunkweb (since you just turned splunkweb off) you will need to use the following cli command:

./splunk enable webserver, then restart splunk and it will be back up.

View solution in original post

Communicator

Can we do this without restarting splunkd

0 Karma
Reply

Engager

I downvoted this post because this is a comment posted as an answer. I recommend deleting this answer and adding it as a comment to one of the answers above in order to get visibility to the right people and get your answer quicker!

0 Karma
Reply

Path Finder

You should also be able to set this in the web.conf file with the following:

[settings]
startwebserver = 0

Path Finder

thanks,

./splunk disable webserver

./splunk enable webserver

easy and fast!

Splunk Employee
Splunk Employee

On Windows, splunkweb is also a formally defined service. You can stop it from running and/or starting from the service manager UI (Admin tools -> Services or right-click on My Computer).

Or you can use the CLI tool 'sc' (e.g. 'sc stop splunkweb' or 'sc config splunkweb start= disabled' (the space is required after '='))

Splunk Employee
Splunk Employee

You can do this via manager.

Login to splunkweb and click on Manager. From the Manager homepage, click on system settings, then general settings.

Under the splunk web section of that form, there are three options, one of them being the one you want.

Splunk Web Run Splunk Web Yes No

Just change Run Splunk Web to No, and submit the form, you will need to restart and after that you will no longer have a splunkweb front end running on your server.

You can also do this via the cli with: ./splunk disable webserver, then restart splunk and it disabled.

To turn this back on, you won't be able to do this via splunkweb (since you just turned splunkweb off) you will need to use the following cli command:

./splunk enable webserver, then restart splunk and it will be back up.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!