Monitoring Splunk

Change splunkd management port on Universal forwarder

skrish91
Path Finder

I would like to change the splunk management port from 8089 to some higher port say 9089. What is the best way to do this? Should i use the Splunk CLI or change it using web.conf file? Also I am using a deployment server to manage the UF. Should I change the port on deployment server as well?

0 Karma
1 Solution

HiroshiSatoh
Champion

Here is the way to change the default splunk forwarder management port:
In "/etc/system/local", add the following file and contents:

web.conf with
[settings]
mgmtHostPort = 127.0.0.1:9089

and restart splunk.

It will be like this.
Splunk Server OR DS(ANY)->UF(9089)
UF(ANY)->DS(8089)

View solution in original post

damann
Communicator

Otherwise you can change splunkd port via Web UI or by CLI as mentioned in this answer:
https://answers.splunk.com/answers/67/how-do-i-change-the-ports-that-splunk-listens-on.html

NOTE: The way you change Management Port by Web UI has changed:
- Log in as Admin
- Go to Settings
- Go to Server settings
- Look for Management port and change it
- Save your work!

0 Karma

HiroshiSatoh
Champion

Here is the way to change the default splunk forwarder management port:
In "/etc/system/local", add the following file and contents:

web.conf with
[settings]
mgmtHostPort = 127.0.0.1:9089

and restart splunk.

It will be like this.
Splunk Server OR DS(ANY)->UF(9089)
UF(ANY)->DS(8089)

skrish91
Path Finder

Ok so we dont need to change anything in deployment server right?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...