Security

How do I find out what port Splunk is running on?

Simeon
Splunk Employee
Splunk Employee

I have installed Splunk multiple times on my machine and I am trying to figure out what ports I have configured. Is there a way to see what ports Splunk is running on?

Tags (2)
1 Solution

Simeon
Splunk Employee
Splunk Employee

There are three ways to verify the ports that are configured for Splunk. By default, Splunk will run on port 8000 for the web services and port 8089 for splunkd services.

  1. Check the $SPLUNK_HOME/etc/system/local/web.conf for port settings:

    mgmtHostPort = 127.0.0.1:8089
    httpport = 8000

  2. Run the following command:

    ./splunk show web-port

    ./splunk show splunkd-port

  3. Use the btool command to see web.conf settings:

    ./splunk cmd btool web list --debug

View solution in original post

tchase
Splunk Employee
Splunk Employee

You can always hit the REST API programatically. For example to find the web port you could use: curl -k -u admin:password https://localhost:8089/services/propertieb/settings/httpport

0 Karma

tchase
Splunk Employee
Splunk Employee

Sorry the web url didn't past properly: curl-u admin:password https://localhost:8089/services/properties/web/settings/httpport

0 Karma

kinjalmistry
Explorer

Is there any way to find out the port on which Splunk is set up programmatically using Splunk Java SDK? Basically to read the entry from $SPLUNK_HOME/etc/system/local/web.conf?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

This would have been better asked in a new question instead of as a reply to an 11 year old one... 😉

You can use a REST API call to get that info programmatically, here's a search example:

| rest /services/server/settings | fields *Port *port

The Java SDK has a class named "Settings" with methods to retrieve host and port values, among other settings.

0 Karma

Ledio_Ago
Splunk Employee
Splunk Employee

By the way, when installing Splunk on Windows, if the default ports (8000, 8089) are taken, Splunk will automatically bind to the next available port.

Simeon
Splunk Employee
Splunk Employee

There are three ways to verify the ports that are configured for Splunk. By default, Splunk will run on port 8000 for the web services and port 8089 for splunkd services.

  1. Check the $SPLUNK_HOME/etc/system/local/web.conf for port settings:

    mgmtHostPort = 127.0.0.1:8089
    httpport = 8000

  2. Run the following command:

    ./splunk show web-port

    ./splunk show splunkd-port

  3. Use the btool command to see web.conf settings:

    ./splunk cmd btool web list --debug

rutherglen
Loves-to-Learn

I didn't have a web.conf at step one of your instructions, so I made it with the K/V pair, my Splunk still didn't work.

I ran the two cmds(one by one), a license agreement came up instead of the results of the cmds, I typed y, and the original error msg came up again, Unable to retrieve splunkd management port using '/Applications/Splunk/bin/splunkd local-rest-uri -p 8089'

0 Karma

rutherglen
Loves-to-Learn

Under what directory do we run ./splunk show web-port please?  I tried it under /Applications/Splunk, it didn't work.

0 Karma

inventsekar
Ultra Champion

Hi @rutherglen 
I tried it under /Applications/Splunk, it didn't work.

I understand you are on linux.. so splunk is mostly installed on /opt/splunk and the splunk executable file is present at /opt/splunk/bin/splunk.

so you should run the above command like this:

/opt/splunk/bin/splunk show web-port

 

for windows users... 

c:\Program Files\Splunk\bin>.\splunk show web-port
WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details.
Splunk username: admin
Password:
Web port: 8000

c:\Program Files\Splunk\bin>

 

Best Regards, Sekar

For Splunk newbies alone, I have created a youtube channel.. pls check it out - https://www.youtube.com/@SplunkNewbies101/videos

 

 

0 Karma

rutherglen
Loves-to-Learn

Well, I am using Mac.  So I tried this cmd: /Applications/Splunk/bin/splunk show web-port

I said yes to the agreement, and I get these error msg's:

subprocess.CalledProcessError: Command '['/Applications/Splunk/bin/splunkd', 'local-rest-uri', '-p', '8089']' died with <Signals.SIGABRT: 6>.

The second error msg is:

During handling of the above exception, another exception occurred:

splunk.clilib.control_exceptions.ConfigError: ("Unable to retrieve splunkd management port using '/Applications/Splunk/bin/splunkd local-rest-uri -p 8089': ",)

Google is not much help.  Thanks a lot for your help so far.

0 Karma

inventsekar
Ultra Champion

i hope this one ur personal splunk i think..(on production splunk we should not face such issues actually;) )

the error looks strange actually.. we need more details... is splunk GUI working fine or not.. 

is data onboarding working fine or not.. approx how long u r facing this issue..

 

if this is ur personal splunk instance, then, maybe, the simple solution is to uninstall and resinstall.. 

 

0 Karma

rutherglen
Loves-to-Learn

Yeah, it's my personal Splunk.  I'm taking a training and trying to follow along.  I'm using an old Mac, 10.12 or 13, I think.  Splunk prob doesn't support lower than 10.14.  But it says it's installed successfully and I have an icon on my desktop.  It self-installed and i never had to select ports, it seems something went wrong with port assignment.  Thanks.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You could run Splunk 8.0.10 on macOS 10.13 and probably 7.2.x on macOS 10.12? https://www.splunk.com/en_us/download/previous-releases.html seems to have at least 8.1.x and 7.1.9 versions for free download.

At least some newer versions can installed into old macOS versions, but it's not sure that those are running without issues on these.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...