You would need to modify the value of SPLUNK_BINDIP in $SPLUNK_HOME/etc/splunk-launch.conf:
https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Splunk-launchconf
SPLUNK_BINDIP=<ip address>
* Specifies an interface that splunkd and splunkweb should bind to, as
opposed to binding to the default for the local operating system.
* If unset, Splunk makes no specific request to the operating system when
binding to ports/opening a listening socket. This means it effectively
binds to '*'; i.e. an unspecified bind. The exact result of this is
controlled by operating system behavior and configuration.
* NOTE: When using this setting you must update mgmtHostPort in web.conf to
match, or the command line and splunkweb will not know how to
reach splunkd.
* For splunkd, this sets both the management port and the receiving ports
(from forwarders).
* Useful for a host with multiple IP addresses, either to enable
access or restrict access; though firewalling is typically a superior
method of restriction.
* Overrides the Splunkweb-specific web.conf/[settings]/server.socket_host
param; the latter is preferred when SplunkWeb behavior is the focus.
* Defaults to unset.
Be careful when modifying this variable. Certain apps that store credentials for modular inputs often try to retrieve those credentials by hitting REST endpoints on localhost. If Splunk isn't bound to localhost it could cause the modular inputs to fail.
... View more
