Do services typically running on a heavy forwarder?



I have two machines one looks like it's a heavy forwarder, I can browse into the GUI of the first Splunk server but cannot browse into the GUI  on the heavy forwarder. is this normal?


do you usually have a GUI access on the heavy forwarder??. is there a service that needs to be running to allow it to serve web traffic.?



Labels (1)
0 Karma


It's common for HFs to have the GUI enabled, but not required.  

The GUI is enabled or disabled by the startwebserver setting in web.conf.  It's also possible the default port of 8000 was changed to something by the httpport setting in the same file.  As always, a firewall could be blocking your connection to one HF.

If this reply helps you, Karma would be appreciated.


As @richgalloway said it's normal that there is no GUI unless HF runs some TAs which needs/are easier to configure with GUI like TA-AWS, VMWare, DBX. All other cases it's better to disable GUI on all Splunk servers which don't need those. This is based on Security best practices.

Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...