What is the purpose of our Splunk instance phoning home to an external IP over port 443?

[jbsplunk]

We've noticed that our splunk server was phoning home to an external IP over port 443.  What's the purpose of this traffic?

[jreuter_splunk]

This is most likely splunk phoning home to apps.splunk.com to check for updates. You can verifiy if this is the case by looking up the destination IP:

dig +short apps.splunk.com
54.187.11.200

dig +short -x 54.187.11.200
ec2-54-187-11-200.us-west-2.compute.amazonaws.com.

You should see a correlating event in the splunkd.log, but I believe only if there is an error:

WARN  HTTPClient - Connect to=apps.splunk.com:443 timed out; exceeded 10sec
ERROR ApplicationUpdater - Error checking for update, URL=/api/apps:resolve/checkforupgrade: Connect to=https://apps.splunk.com timed out; exceeded 10sec
ERROR HTTPClient - Cannot resolve IP of host=apps.splunk.com: No such host is known.

If you would like to disable this behavior, check this answer:
http://answers.splunk.com/answers/28616/how-can-automatic-update-checking-be-disabled-for-splunkbase...