Deployment Architecture

Binding web interface to a specific IP address

pasimon
New Member

Hi Everyone, I'm just curious how to bind web interface to a specific IP? Last time, my Splunk was working on (specific IP):8000 but when I restarted it became 127.0.0.1:8000 and I can't seem to log in my user credentials.

Someone help please.

0 Karma

pkeenan87
Communicator

You would need to modify the value of SPLUNK_BINDIP in $SPLUNK_HOME/etc/splunk-launch.conf:

https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Splunk-launchconf

SPLUNK_BINDIP=<ip address>
* Specifies an interface that splunkd and splunkweb should bind to, as
  opposed to binding to the default for the local operating system.
* If unset, Splunk makes no specific request to the operating system when
  binding to ports/opening a listening socket.  This means it effectively
  binds to '*'; i.e.  an unspecified bind.  The exact result of this is
  controlled by operating system behavior and configuration.
* NOTE: When using this setting you must update mgmtHostPort in web.conf to
  match, or the command line and splunkweb will not know how to
  reach splunkd.
* For splunkd, this sets both the management port and the receiving ports
  (from forwarders).
* Useful for a host with multiple IP addresses, either to enable
  access or restrict access; though firewalling is typically a superior
  method of restriction.
* Overrides the Splunkweb-specific web.conf/[settings]/server.socket_host
  param; the latter is preferred when SplunkWeb behavior is the focus.
* Defaults to unset. 

Be careful when modifying this variable. Certain apps that store credentials for modular inputs often try to retrieve those credentials by hitting REST endpoints on localhost. If Splunk isn't bound to localhost it could cause the modular inputs to fail.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...