Splunk "receiver" listening on 9997, but only on localhost?

[mikeforbes]

I've enabled the receiver option on my splunk (free) install - and running a splunk universal forwarder on another host..

But it seems the splunk install only listens on localhost?

tcp 0 0 127.0.0.1:9997 0.0.0.0:* LISTEN

Any idea where I can change this, or what might be wrong?

Thanks!

[mikeforbes · Accepted solution]

Yeah, think I figured this out myself.

if

SPLUNK_BINDIP=127.0.0.1

is set in /opt/splunk/etc/splunk-launch.conf (linux example)

Then it seems all the other listen functions are set to the same localhost.

I've undone this feature and started to firewall off the management port etc.

Happy days.

[mikeforbes]

Yep, as you can see from the paste, (straight from netstat on the machine) - It's not even trying to listen on all interfaces, just 127.0.0.1

[sideview]

Are you sure there isn't a firewall in this picture somewhere? You've probably eliminated this long ago but this question and solution does crop up a fair bit so I thought I'd ask.