Monitoring Splunk

Splunk "receiver" listening on 9997, but only on localhost?

mikeforbes
Explorer

I've enabled the receiver option on my splunk (free) install - and running a splunk universal forwarder on another host..

But it seems the splunk install only listens on localhost?

tcp 0 0 127.0.0.1:9997 0.0.0.0:* LISTEN

Any idea where I can change this, or what might be wrong?

Thanks!

Tags (3)
1 Solution

mikeforbes
Explorer

Yeah, think I figured this out myself.

if

SPLUNK_BINDIP=127.0.0.1

is set in /opt/splunk/etc/splunk-launch.conf (linux example)

Then it seems all the other listen functions are set to the same localhost.

I've undone this feature and started to firewall off the management port etc.

Happy days.

View solution in original post

mikeforbes
Explorer

Yeah, think I figured this out myself.

if

SPLUNK_BINDIP=127.0.0.1

is set in /opt/splunk/etc/splunk-launch.conf (linux example)

Then it seems all the other listen functions are set to the same localhost.

I've undone this feature and started to firewall off the management port etc.

Happy days.

mikeforbes
Explorer

Yep, as you can see from the paste, (straight from netstat on the machine) - It's not even trying to listen on all interfaces, just 127.0.0.1

0 Karma

sideview
SplunkTrust
SplunkTrust

Are you sure there isn't a firewall in this picture somewhere? You've probably eliminated this long ago but this question and solution does crop up a fair bit so I thought I'd ask.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...