How do I bind Splunk to a specific interface?

[matt]

I want to Splunk to listen on a specific interface not 0.0.0.0. How do I do this?

[ddarmand]

Does this working anymore ? i can't find this conf file

[aafogles]

Works okay at face value, but it seems to break Splunk Web, since the Web Server apparently still looks for the loopback IP (127.0.0.1) for management (8089). Not sure what other features using this setting might break.
Edited Looked more into the documentation. If you intend on using Web, ensure you configure web.conf to use the specified IP. See https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/BindSplunktoanIP for details

[MikeKulls]

And yes it still works as of v6.1

[MikeKulls]

/opt/splunk/etc/splunk-launch.conf

[jrodman · Accepted solution]

You can set SPLUNK_BINDIP in etc/splunk-launch.conf, eg

SPLUNK_BINDIP=127.0.0.1

The address must be an address that the host actually has, for useful results.

[Shahrukh_S]

If a DHCP is assigning IP address to your Splunk server, do not go for this. 

You will also need to add the following line to /etc/system/local/web.conf 

[settings]
mgmtHostPort = 10.10.x.x:8089

_______________________________________________________________

Otherwise, splunk default stanza (below) will look for splunkd at its loopback address. 

/opt/splunk/etc/system/default/web.conf
mgmtHostPort = 127.0.0.1:8089

[jrodman]

Probably not. I'm not aware of any ability to do so.

[balbano]

can you bind more than one IP?