Hi
I have a situation where i had to change the mgmtHostPort on my forwarder from 8089 to 9089 as it would not start as it said address already in use. When SPLUNK starts is does uses this port for the mgmtHostPort.
The forwarder works as it write data to the index on 9997.
The question is what is mgmtHostPort used for on the forwarder?
https://answers.splunk.com/answers/118859/diagram-of-splunk-common-network-ports.html
It allows you (or software) to administer it through a web interface. It is a common security best practice to disable it entirely on forwarders in server.conf like this:
[httpServer]
# Disable management port to prevent remote (or local) config.
disableDefaultPort = true
Hi,
hope this helps.
regards