<  Back |Home| Next  >

Common ports used by Splunk :

Q: What are the common port numbers used by Splunk OR
 What are the ports that I need to open while configuring Splunk?

Below are the most common port numbers used by Splunk, however you can change them if required as per needs:

Service                                        Port number Used

Splunk Web Port:                                 8000

Splunk Management Port:                  8089

Splunk Indexing Port:                         9997

Splunk Index Replication Port           8080

Splunk network port:                         514 (Used to get data in from netwok port i.e. UDP data)


Refer Below diagram for more detailed view:

 

                                                                                                Splunk Common Network ports


Q: How to change default port numbers in splunk?

There may be certain conditions where you may  need to change default port numbers used.Most of the case due to security reasons OR if other service is using the port then You can change the default values by following below steps:

Using Splunk WebTo change the ports from their installation settings: 

1. Log into Splunk Web as the admin user. 
2. Click Manager in the top-right of the interface. 
3. Click the System settings link in the System section of the screen. 
4. Click General settings. 
5. Change the value for either Management port or Web port, and click Save. 
Using  Splunk CLITo change the port settings via the Splunk CLI, use the CLI command set.

 For example, this command sets the Splunk Web port to 9000:

splunk set web-port 9000

 This command sets the splunkd port to 9089:

splunk set splunkd-port 9089 


Q:  How to check ports used by splunk in existing splunk installation/environment?


You can check port numbers used by existing splunk installation by using below commands:


./splunk show web-port
./splunk show splunkd-port



 OR you need check web.conf which is located at below location:

$SPLUNK_HOME/etc/system/local/ web.conf 

and find the  line marked in red as below:
 httpport = <port_number> * Must be present for SplunkWeb to start. * If omitted or 0 the server will NOT start an http listener. * If using SSL, set to the HTTPS port number. * Defaults to 8000. mgmtHostPort = <IP:port> * Location of splunkd. * Don't include http[s]:// -- just the IP address. * Defaults to 127.0.0.1:8089.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

                                                                                                     <  Back |Home| Next  >

Comment Box is loading comments...