Which SSL Configurations Affect Which Port


I was hoping to get some clarification on this as there is no specific information that I could find in the documentation.

We obviously have these main ports in use for most Splunk installations.

  • Port 8000 - Splunk Web interface
  • Port 8089 - Splunk internal comms
  • Port 9997 - Splunk receiving

Would this graphic I put together accurately describe which .conf configurations affect each of the above?

alt text

I know there used to be some overlap with the some of the SSL configurations in server.conf which impact port 8000 but in recent Splunk releases it appears to have been separated out and compartmentalised to be contained in web.conf

Is there something missing from my diagram?

Are there any server.conf settings still affect the Splunk web on 8000 at all?


Tags (2)
0 Karma

Super Champion

per my knowledge your understandings are clear and good.
let me check again..

PS - maybe, you could have added the image directly, instead of imgur.

0 Karma


Yeah there is still confusion amongst some of our engineers (and splunk support) who are convinced server.conf settings can affect the port 8000. We are not sure which is right yet.

Notably things like cipherSuite, sslVersions and sslVersionsForClient.

Thanks for the tip. I forgot you could add images directly (fixed it up)

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...