Is there any way to use different Splunk Web ports specific for different users?

[vganjare]

Hi,

Is there any way to use different ports (from same machine) for different users? The splunk training which is conducted on AWS server, every student gets separate ports for splunk web, splunkd and splunk management (on same IP). What setting is required to achieve the same?

Thanks!!

[esix_splunk · Accepted solution]

In the training, those are all separate instances of Splunk. Not a a root instance with child nodes running.

If you want to install and run multiple instances of Splunk on the same box, all you need to do is install them to different directories and run them on different ports.

Now depending on what you want to do, you could technically run each instance and a different user. E.g., /opt/splunk1 on port 8000 runs as user1, /opt/splunk2 on port 8001 runs as user2, etc.

You can do that by editing the configuration files after starting splunk and specifying the following in $splunk_home$/etc/system/local/web.conf

[settings]
httpport = 8000
mgmtHostPort = 127.0.0.1:8089

In order to get splunk to run as a different user, you need to configure the boot start user:

$splunk_home$/bin/splunk enable boot-start -user myrunasuser

Change the myrunasuser to the username you want to run this as.

A note on this, typically you would run this as a sandbox user, like splunk. And you have the multple instances running with that UID. Aside from a lab, where you want the users to install from scratch, Im not sure of any real use cases for this.