How do I start Splunk on a non-default port, non-interactively?

[weeb]

I need to change the default web server port and the default web server port from default values.

I know there are ways to change the ports once it has started up on the default ports, but I would like to change my configuration non-interactively, i.e. in a way that can be scripted or automated.

[weeb · Accepted solution]

I looked everywhere and couldn't find this, so please upvote if this helped:

If you want to set Splunk to start up with a non-default port, non-interactively, before starting up for first time:

1. Copy the default web.conf from $SPLUNKHOME/etc/system/default/web.conf to $SPLUNK_HOME/etc/system/local/web.conf. (it will not exist in /local until created)

   $ cp $SPLUNKHOME/etc/system/default/web.conf $SPLUNKHOME/etc/system/local/web.conf

More on file precedence here:

1. Remove lines unchanged. Just use the example below if you have no other changes.

2. To change the splunk web server port from the default value of 8000 to 12300, and the default splunk management port from 8089 to 12389, see example below.

   [default]
   [settings]
   httpport = 12300
   mgmtHostPort = 127.0.0.1:12389

3. Save the file. Start splunk.

   $ SPLUNK_HOME/bin/splunk start

Voila! It should confirm ports opened during the start up process:

> Checking prerequisites...
> Checking http port [12300]: open
> Checking mgmt port [12389]: open