Documentation > Splunk > Admin Manual > Bind Splunk to an IP

Admin Manual

 


Welcome to Splunk administration
What to do first
Use Splunk Web
Getting started for Windows admins
Manage Splunk licenses
Meet Splunk apps
Configure Splunk
Indexing with Splunk
Manage users
Manage indexes
Define alerts
Set up backups and retention policies
Configure data security
Manage search jobs
Use Splunk's command line interface (CLI)
Configuration file reference
Troubleshooting

Bind Splunk to an IP

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

Bind Splunk to an IP

You can force Splunk to bind its ports to a specified IP address. By default, Splunk will bind to the IP address 0.0.0.0, meaning all available IP addresses.

Changing Splunk's bind IP only applies to the Splunk daemon (splunkd), which listens on:

  • TCP port 8089 (by default)
  • any port that has been configured as for:
    • SplunkTCP inputs
    • TCP or UDP inputs

To bind the Splunk Web process (splunkweb) to a specific IP, use the server.socket_host setting in web.conf.

Temporarily

To make this a temporary change, set the environment variable SPLUNK_BINDIP=<ipaddress> before starting Splunk.

Permanently

If you want this to be a permanent change in your working environment, modify $SPLUNK_HOME/etc/splunk-launch.conf to include the SPLUNK_BINDIP attribute and <ipaddress> value. For example, to bind Splunk ports to 127.0.0.1, splunk-launch.conf should read: 

# Modify the following line to suit the location of your Splunk install.
# If unset, Splunk will use the parent of the directory this configuration
# file was found in
#
# SPLUNK_HOME=/opt/splunk
SPLUNK_BINDIP=127.0.0.1

Important: The mgmtHostPort attribute in web.conf has a default value of 127.0.0.1:8089. Therefore, if you change SPLUNK_BINDIP to any value besides 127.0.0.1, you must also change mgmtHostPort to use the same IP address. For example, if you make this change in splunk-launch.conf: 

SPLUNK_BINDIP=129.0.0.1

you must also make this change in web.conf (assuming the management port is 8089): 

mgmtHostPort=129.0.0.1:8089

See web.conf for more information on the mgmtHostPort attribute.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.2.3/Admin/BindSplunktoanIP"

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!