How do I find out what port Splunk is running on?

[Simeon]

I have installed Splunk multiple times on my machine and I am trying to figure out what ports I have configured. Is there a way to see what ports Splunk is running on?

[tchase]

You can always hit the REST API programatically. For example to find the web port you could use: curl -k -u admin:password https://localhost:8089/services/propertieb/settings/httpport

[tchase]

Sorry the web url didn't past properly: curl-u admin:password https://localhost:8089/services/properties/web/settings/httpport

[kinjalmistry]

Is there any way to find out the port on which Splunk is set up programmatically using Splunk Java SDK? Basically to read the entry from $SPLUNK_HOME/etc/system/local/web.conf?

[s2_splunk]

This would have been better asked in a new question instead of as a reply to an 11 year old one... 😉

You can use a REST API call to get that info programmatically, here's a search example:

| rest /services/server/settings | fields *Port *port

The Java SDK has a class named "Settings" with methods to retrieve host and port values, among other settings.

[Ledio_Ago]

By the way, when installing Splunk on Windows, if the default ports (8000, 8089) are taken, Splunk will automatically bind to the next available port.

[Simeon · Accepted solution]

There are three ways to verify the ports that are configured for Splunk. By default, Splunk will run on port 8000 for the web services and port 8089 for splunkd services.

1. Check the $SPLUNK_HOME/etc/system/local/web.conf for port settings:

   mgmtHostPort = 127.0.0.1:8089
   httpport = 8000

2. Run the following command:

   ./splunk show web-port

   ./splunk show splunkd-port

3. Use the btool command to see web.conf settings:

   ./splunk cmd btool web list --debug

[rutherglen]

I didn't have a web.conf at step one of your instructions, so I made it with the K/V pair, my Splunk still didn't work.

I ran the two cmds(one by one), a license agreement came up instead of the results of the cmds, I typed y, and the original error msg came up again, Unable to retrieve splunkd management port using '/Applications/Splunk/bin/splunkd local-rest-uri -p 8089'

[rutherglen]

Under what directory do we run ./splunk show web-port please?  I tried it under /Applications/Splunk, it didn't work.

[inventsekar]

Hi @rutherglen 
I tried it under /Applications/Splunk, it didn't work.

I understand you are on linux.. so splunk is mostly installed on /opt/splunk and the splunk executable file is present at /opt/splunk/bin/splunk.

so you should run the above command like this:

/opt/splunk/bin/splunk show web-port

for windows users... 

c:\Program Files\Splunk\bin>.\splunk show web-port
WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details.
Splunk username: admin
Password:
Web port: 8000

c:\Program Files\Splunk\bin>

Best Regards, Sekar

For Splunk newbies alone, I have created a youtube channel.. pls check it out - https://www.youtube.com/@SplunkNewbies101/videos

[rutherglen]

Well, I am using Mac.  So I tried this cmd: /Applications/Splunk/bin/splunk show web-port

I said yes to the agreement, and I get these error msg's:

subprocess.CalledProcessError: Command '['/Applications/Splunk/bin/splunkd', 'local-rest-uri', '-p', '8089']' died with <Signals.SIGABRT: 6>.

The second error msg is:

During handling of the above exception, another exception occurred:

splunk.clilib.control_exceptions.ConfigError: ("Unable to retrieve splunkd management port using '/Applications/Splunk/bin/splunkd local-rest-uri -p 8089': ",)

Google is not much help.  Thanks a lot for your help so far.

[inventsekar]

i hope this one ur personal splunk i think..(on production splunk we should not face such issues actually;) )

the error looks strange actually.. we need more details... is splunk GUI working fine or not.. 

is data onboarding working fine or not.. approx how long u r facing this issue..

if this is ur personal splunk instance, then, maybe, the simple solution is to uninstall and resinstall.. 

[rutherglen]

Yeah, it's my personal Splunk.  I'm taking a training and trying to follow along.  I'm using an old Mac, 10.12 or 13, I think.  Splunk prob doesn't support lower than 10.14.  But it says it's installed successfully and I have an icon on my desktop.  It self-installed and i never had to select ports, it seems something went wrong with port assignment.  Thanks.

[isoutamo]

Hi

You could run Splunk 8.0.10 on macOS 10.13 and probably 7.2.x on macOS 10.12? https://www.splunk.com/en_us/download/previous-releases.html seems to have at least 8.1.x and 7.1.9 versions for free download.

At least some newer versions can installed into old macOS versions, but it's not sure that those are running without issues on these.

r. Ismo

[vidyaEdilebert]

I found it in this folder structure --> C:\Program Files\Splunk\etc\system\default\web.conf