Monitoring Splunk

Splunk "receiver" listening on 9997, but only on localhost?

mikeforbes
Explorer

I've enabled the receiver option on my splunk (free) install - and running a splunk universal forwarder on another host..

But it seems the splunk install only listens on localhost?

tcp 0 0 127.0.0.1:9997 0.0.0.0:* LISTEN

Any idea where I can change this, or what might be wrong?

Thanks!

Tags (3)
1 Solution

mikeforbes
Explorer

Yeah, think I figured this out myself.

if

SPLUNK_BINDIP=127.0.0.1

is set in /opt/splunk/etc/splunk-launch.conf (linux example)

Then it seems all the other listen functions are set to the same localhost.

I've undone this feature and started to firewall off the management port etc.

Happy days.

View solution in original post

mikeforbes
Explorer

Yeah, think I figured this out myself.

if

SPLUNK_BINDIP=127.0.0.1

is set in /opt/splunk/etc/splunk-launch.conf (linux example)

Then it seems all the other listen functions are set to the same localhost.

I've undone this feature and started to firewall off the management port etc.

Happy days.

mikeforbes
Explorer

Yep, as you can see from the paste, (straight from netstat on the machine) - It's not even trying to listen on all interfaces, just 127.0.0.1

0 Karma

sideview
SplunkTrust
SplunkTrust

Are you sure there isn't a firewall in this picture somewhere? You've probably eliminated this long ago but this question and solution does crop up a fair bit so I thought I'd ask.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...