Change Splunk server default settings
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Change Splunk server default settings
After you start a new installation of Splunk, you may want to change a number of the default settings. This is a quick guide for using Splunk Web to change the admin default password, your Splunk server name, the Web and splunkd network ports, the datastore location, and the minimum free disk space.
You can make all of these changes from the Admin > Users and Admin > Server: View Settings pages in Splunk Web. Refer to the User Manual for more information About Splunk Web.
Note: You can also make these changes using Splunk's CLI.
Change the password
Splunk with a Free license does not require login authentication. However, Splunk with an Enterprise license does require authentication and ships with a default administrator account with username admin and password changeme.
To change the administrator password:
1. Navigate to the Admin > Users page in Splunk Web.
2. For the username admin, click Edit from the Action column.
The admin user properties page opens.
3. Enter your new password twice (under Password and Confirm Password).
4. Click Save.
You return to the Admin > Users page with a note at the top, "User admin updated."
Change Splunk server name
The Splunk server name is the identity of that particular instance. This name is displayed within Splunk Web and is sent to other Splunk servers in a distributed setting. The default name is taken from either the DNS or IP address of the Splunk server host.
To change the Splunk server name:
1. Navigate to the Admin > Server: View Settings page in Splunk Web.
2. In the Basic Settings section, enter a new Splunk server name.
3. Click Save.
Change network ports
Splunk uses two network ports that default to:
-
8000: HTTP or HTTPS socket for Splunk Web. -
8089: Splunk management port.
Note: Splunk Web, the command line interface, and any distributed connections from other servers use the Splunk management port to communicate with the splunkd daemon.
To change the network ports:
1. Navigate to the Admin > Server: View Settings page in Splunk Web.
2. In the Basic Settings section, enter a new Splunkd port number (under Splunkd port #).
3. In the Splunk Web section, enter a new Web port number (under Web port).
4. Click Save.
Change datastore location
The datastore path is the top-level directory where the Splunk server stores all indexed data, user information, and working files. If you turn off local indexing and only forward data in a distributed setup, this server still requires a few megabytes of available space in the datastore path.
Important: If you change this directory, the server does not migrate old datastore files. Instead, it starts over in the new location. To migrate your data to another directory, refer to the instructions in Move an index.
To change the datastore location:
1. Navigate to the Admin > Server: View Settings page in Splunk Web.
2. In the Datastore section, enter a new Datastore path.
3. Click Save.
Change minimum free disk space
The minimum free disk space defines a storage space limit before Splunk stops indexing. Splunk resumes indexing when more space becomes available. For more information on managing Splunk disk usage, see Disk usage.
To change the minimum free disk space:
1. Navigate to the Admin > Server: View Settings page in Splunk Web.
2. In the Datastore section, enter a new limit under "Pause indexing if free disk space falls below".
3. Click Save.
This documentation applies to the following versions of Splunk: 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13 , 3.4.14 View the Article History for its revisions.