How do I find out what port splunkd is running on if its not 8089?
You should see it in Manager -> System Settings -> General Settings.
View solution in original post
Also in $splunk_home/etc/system/local/web.conf if for some reason you don't have the UI.
mgmtHostPort = IP:port
* Location of splunkd.
* Don't include http[s]:// -- just the IP address.
* Defaults to 127.0.0.1:8089.
Great for running multiple copies of Splunk on a server with no access to the Web interface.