Splunk is bind to an IP 127.0.0.1

Splunk Enterprise

We have below stanza in /opt/splunk/etc/splunk-launch.conf file of the heavy forwarder to avoid any security risks. This means the heavy forwarder is bind to localhost only.

SPLUNK_BINDIP=127.0.0.1

However, we want to receive the data on this heavy forwarder from a specific machine using the HTTP event collector app.

Is there any way to receive the events without removing this stanza? Has anyone else faced a similar situation?

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience, ...