Deployment Architecture

Binding web interface to a specific IP address

pasimon
New Member

Hi Everyone, I'm just curious how to bind web interface to a specific IP? Last time, my Splunk was working on (specific IP):8000 but when I restarted it became 127.0.0.1:8000 and I can't seem to log in my user credentials.

Someone help please.

0 Karma

pkeenan87
Communicator

You would need to modify the value of SPLUNK_BINDIP in $SPLUNK_HOME/etc/splunk-launch.conf:

https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Splunk-launchconf

SPLUNK_BINDIP=<ip address>
* Specifies an interface that splunkd and splunkweb should bind to, as
  opposed to binding to the default for the local operating system.
* If unset, Splunk makes no specific request to the operating system when
  binding to ports/opening a listening socket.  This means it effectively
  binds to '*'; i.e.  an unspecified bind.  The exact result of this is
  controlled by operating system behavior and configuration.
* NOTE: When using this setting you must update mgmtHostPort in web.conf to
  match, or the command line and splunkweb will not know how to
  reach splunkd.
* For splunkd, this sets both the management port and the receiving ports
  (from forwarders).
* Useful for a host with multiple IP addresses, either to enable
  access or restrict access; though firewalling is typically a superior
  method of restriction.
* Overrides the Splunkweb-specific web.conf/[settings]/server.socket_host
  param; the latter is preferred when SplunkWeb behavior is the focus.
* Defaults to unset. 

Be careful when modifying this variable. Certain apps that store credentials for modular inputs often try to retrieve those credentials by hitting REST endpoints on localhost. If Splunk isn't bound to localhost it could cause the modular inputs to fail.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...