Dashboards & Visualizations

How do I start Splunk on a non-default port, non-interactively?

weeb
Splunk Employee
Splunk Employee

I need to change the default web server port and the default web server port from default values.

I know there are ways to change the ports once it has started up on the default ports, but I would like to change my configuration non-interactively, i.e. in a way that can be scripted or automated.

1 Solution

weeb
Splunk Employee
Splunk Employee

I looked everywhere and couldn't find this, so please upvote if this helped:

If you want to set Splunk to start up with a non-default port, non-interactively, before starting up for first time:

  1. Copy the default web.conf from $SPLUNKHOME/etc/system/default/web.conf to $SPLUNK_HOME/etc/system/local/web.conf. (it will not exist in /local until created)

    $ cp $SPLUNKHOME/etc/system/default/web.conf $SPLUNKHOME/etc/system/local/web.conf

More on file precedence here:

  1. Remove lines unchanged. Just use the example below if you have no other changes.

  2. To change the splunk web server port from the default value of 8000 to 12300, and the default splunk management port from 8089 to 12389, see example below.

    [default]
    [settings]
    httpport = 12300
    mgmtHostPort = 127.0.0.1:12389

  3. Save the file. Start splunk.

    $ SPLUNK_HOME/bin/splunk start

Voila! It should confirm ports opened during the start up process:

> Checking prerequisites...
> Checking http port [12300]: open
> Checking mgmt port [12389]: open

View solution in original post

weeb
Splunk Employee
Splunk Employee

I looked everywhere and couldn't find this, so please upvote if this helped:

If you want to set Splunk to start up with a non-default port, non-interactively, before starting up for first time:

  1. Copy the default web.conf from $SPLUNKHOME/etc/system/default/web.conf to $SPLUNK_HOME/etc/system/local/web.conf. (it will not exist in /local until created)

    $ cp $SPLUNKHOME/etc/system/default/web.conf $SPLUNKHOME/etc/system/local/web.conf

More on file precedence here:

  1. Remove lines unchanged. Just use the example below if you have no other changes.

  2. To change the splunk web server port from the default value of 8000 to 12300, and the default splunk management port from 8089 to 12389, see example below.

    [default]
    [settings]
    httpport = 12300
    mgmtHostPort = 127.0.0.1:12389

  3. Save the file. Start splunk.

    $ SPLUNK_HOME/bin/splunk start

Voila! It should confirm ports opened during the start up process:

> Checking prerequisites...
> Checking http port [12300]: open
> Checking mgmt port [12389]: open
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...