Binding web interface to a specific IP address

[pasimon]

Hi Everyone, I'm just curious how to bind web interface to a specific IP? Last time, my Splunk was working on (specific IP):8000 but when I restarted it became 127.0.0.1:8000 and I can't seem to log in my user credentials.

Someone help please.

[pkeenan87]

You would need to modify the value of SPLUNK_BINDIP in $SPLUNK_HOME/etc/splunk-launch.conf:

https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Splunk-launchconf

SPLUNK_BINDIP=<ip address>
* Specifies an interface that splunkd and splunkweb should bind to, as
  opposed to binding to the default for the local operating system.
* If unset, Splunk makes no specific request to the operating system when
  binding to ports/opening a listening socket.  This means it effectively
  binds to '*'; i.e.  an unspecified bind.  The exact result of this is
  controlled by operating system behavior and configuration.
* NOTE: When using this setting you must update mgmtHostPort in web.conf to
  match, or the command line and splunkweb will not know how to
  reach splunkd.
* For splunkd, this sets both the management port and the receiving ports
  (from forwarders).
* Useful for a host with multiple IP addresses, either to enable
  access or restrict access; though firewalling is typically a superior
  method of restriction.
* Overrides the Splunkweb-specific web.conf/[settings]/server.socket_host
  param; the latter is preferred when SplunkWeb behavior is the focus.
* Defaults to unset. 

Be careful when modifying this variable. Certain apps that store credentials for modular inputs often try to retrieve those credentials by hitting REST endpoints on localhost. If Splunk isn't bound to localhost it could cause the modular inputs to fail.