change universal forwarder 4.2 mgmt port

[deyeo]

How do i change the 4.2 universal forwarder's management port from 8089 to other ports (to prevent conflict with existing port tcp 8089 on my server).

in 4.1, we can change it in the web.conf but it does not work in 4.2 universal forwarder.

[proctorgeorge]

If you are looking to change the port that the deployment client (forwarder) looks for on the deployment server to receive its configurations from, then it is set at *\SplunkUniversalForwarder\etc\system\local in deploymentclient.conf which looks like this:

[target-broker:deploymentServer]
targetUri = deployservername:8089

If you are looking for the port that a deployment server manages from, then use mgmtHostPort in web.conf as others have answered.

[emhimes]

Thanks - this helped me figure out how to get forwarding working again after a LAN IP migration. I had to dive into an existing Splunk server configuration w/ no documentation by the guy who set it up.

[MarioM]

you can create or modify /splunk/etc/system/local/web.conf with the following value:

[settings]
mgmtHostPort = 127.0.0.1:8090

I tested it on mine and it's works.

[MarioM]

yes i understood it was and i tried on Universal Forwarder.
Is the folder or file permissions ok ? Did you use same syntax in your web.conf as me?

[deyeo]

that is strange. it does not work for me. take note that it is splunk 4.2 universal forwarder which is a separate installer (splunkforwarder-4.2-96430-xxxx) file from the usual splunk installer, and it installs by default at /opt/splunkforwarder and not the usual /opt/splunk

based on the path that you given, it does not seem that you have tested on splunk 4.2 UNIVERSAL FORWARDER

[MarioM]

You can do it in command line:

splunk set splunkd-port <port number>

[deyeo]

not exactly viable. because Splunk must be running in order to run the CLI command. And the moment i start & run my Splunk, the Splunk default port would have immediately conflict with existing TCP8089 (before i can even run the CLI command).

Is there a way to change the management port on the first time Splunk starts up (so that it never ever run on TCP8089)?