Getting Data In

Change Splunk IP

ShaunBaker
Path Finder

How do I successfully change the Splunk instance (all in one indexer, search head, webUI etc) VM's IP address?

Since Splunk 7 - 8, the Splunk install automatically uses the VMWare admin interface making it so I can only log into Splunk via the VM.

I follow the Bind IP instructions here : https://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/BindSplunktoanIP to get it to where I can now log into the webUI via the IP I specify, but this breaks Splunk. Upon reboot I get a 500 service not found. IP and ports are as specified when I reboot Splunk, but the webUI will no longer work and I have to restore from a snapshot.

token2
Path Finder

I'm fairly certain with Splunk 7.3.1 following the BindIP instructions brakes the webUI.

When I clear out the stanza to bind the IP I can log back into splunk again from within the VM (as Splunk is choosing the virbr0 interface for some reason).

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...