Security

Change splunk web server from the default setting of port 8000 to port 8081

boris
Path Finder

How do I change the splunk web server's port 8000 to port 8081?

Using port 8080 I can not access the web server, which is on a Amazon EC2 machine. Our EC2 Security Groups lists port 8081 as open.

Tags (1)
1 Solution

ilyaresh
Path Finder

These are the ports that Ive had to change (Search Head in my case)

Can be done in conf files

etc/system/local/web.conf
[settings]
httpport = 18443
mgmtHostPort = 18089
appServerPorts = 18065

etc/system/local/server.conf
[kvstore]
port = 18191

Or you can do it form the CLI
splunk set web-port set the port that Splunk Web listens on
splunk set splunkd-port new port that splunkd should listen on
splunk set kvstore-port sets the port that the KV Store uses
splunk set appserver-ports new port that Splunk application server should listen on

kranthimutyala
Explorer

when im changing web port t o 8001 in web.config its giving access denied error

0 Karma

Herman
Explorer

How to you adjust the values in web.config?

0 Karma

scelikok
Champion

Hi @Herman,

You can change it via GUI;

Settings | Server settings  » General settings

If this reply helps you an upvote is appreciated.
0 Karma

apfender_splunk
Splunk Employee
Splunk Employee

When on linux based OS, you actually can also leave everything default to avoid confusions by doing a port translation on the OS level:

sudo ipfw add 100 fwd 127.0.0.1,8000 tcp from any to any 12300 in
sudo ipfw add 101 fwd 127.0.0.1,8089 tcp from any to any 12398 in

and make it permanent in /etc/ipfw.conf

0 Karma

weeb
Splunk Employee
Splunk Employee

I looked everywhere and couldn't find this, so please upvote if this helped:

If you want to set Splunk to start up with a non-default port, non-interactively, before starting up for first time:

  1. Copy the default web.conf from $SPLUNKHOME/etc/system/default/web.conf to $SPLUNK_HOME/etc/system/local/web.conf. (it will not exist in /local until created)

    $ cp $SPLUNKHOME/etc/system/default/web.conf $SPLUNKHOME/etc/system/local/web.conf

More on file precedence here:

  1. Remove lines unchanged. Just use the example below if you have no other changes.

  2. To change the splunk web server port from the default value of 8000 to 12300, and the default splunk management port from 8089 to 12389, see example below.

    [default]
    [settings]
    httpport = 12300
    mgmtHostPort = 127.0.0.1:12389

  3. Save the file. Start splunk.

    $ SPLUNK_HOME/bin/splunk start

Voila! It should confirm ports opened during the start up process:

> Checking prerequisites...
> Checking http port [12300]: open
> Checking mgmt port [12389]: open

jukilo
New Member

This information won't be enough as it will ask for the default credentials, which are admin/changeme.

0 Karma