If you are looking to change the port that the deployment client (forwarder) looks for on the deployment server to receive its configurations from, then it is set at *\SplunkUniversalForwarder\etc\system\local in deploymentclient.conf which looks like this:
[target-broker:deploymentServer]
targetUri = deployservername:8089
If you are looking for the port that a deployment server manages from, then use mgmtHostPort in web.conf as others have answered.
Thanks - this helped me figure out how to get forwarding working again after a LAN IP migration. I had to dive into an existing Splunk server configuration w/ no documentation by the guy who set it up.
you can create or modify /splunk/etc/system/local/web.conf with the following value:
[settings]
mgmtHostPort = 127.0.0.1:8090
I tested it on mine and it's works.
yes i understood it was and i tried on Universal Forwarder.
Is the folder or file permissions ok ? Did you use same syntax in your web.conf as me?
that is strange. it does not work for me. take note that it is splunk 4.2 universal forwarder which is a separate installer (splunkforwarder-4.2-96430-xxxx) file from the usual splunk installer, and it installs by default at /opt/splunkforwarder and not the usual /opt/splunk
based on the path that you given, it does not seem that you have tested on splunk 4.2 UNIVERSAL FORWARDER
You can do it in command line:
splunk set splunkd-port <port number>
not exactly viable. because Splunk must be running in order to run the CLI command. And the moment i start & run my Splunk, the Splunk default port would have immediately conflict with existing TCP8089 (before i can even run the CLI command).
Is there a way to change the management port on the first time Splunk starts up (so that it never ever run on TCP8089)?