Splunk® Enterprise

Admin Manual

Download manual as PDF

Download topic as PDF

Bind Splunk to an IP

You can force Splunk to bind its ports to a specified IP address. By default, Splunk will bind to the IP address, meaning all available IP addresses.

Changing Splunk's bind IP only applies to the Splunk daemon (splunkd), which listens on:

  • TCP port 8089 (by default)
  • any port that has been configured as for:
    • SplunkTCP inputs
    • TCP or UDP inputs

To bind the Splunk Web process (splunkweb) to a specific IP, use the server.socket_host setting in web.conf.


To make this a temporary change, set the environment variable SPLUNK_BINDIP=<ipaddress> before starting Splunk.


If you want this to be a permanent change in your working environment, modify $SPLUNK_HOME/etc/splunk-launch.conf to include the SPLUNK_BINDIP attribute and <ipaddress> value. For example, to bind Splunk ports to (for local loopback only), splunk-launch.conf should read:

# Modify the following line to suit the location of your Splunk install.
# If unset, Splunk will use the parent of the directory this configuration
# file was found in
# SPLUNK_HOME=/opt/splunk

Important: The mgmtHostPort attribute in web.conf has a default value of Therefore, if you change SPLUNK_BINDIP to any value besides, you must also change mgmtHostPort to use the same IP address. For example, if you make this change in splunk-launch.conf:


you must also make this change in web.conf (assuming the management port is 8089):


See web.conf for more information on the mgmtHostPort attribute.

IPv6 considerations

Starting in version 4.3, the web.conf mgmtHostPort setting has been extended to allow it to take IPv6 addresses if they are enclosed in square brackets. Therefore, if you configure splunkd to only listen on IPv6 (via the setting in server.conf described in "Configure Splunk for IPv6" in this manual), you must change this from to [::1]:8089.

Change default values
Configure Splunk for IPv6

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.6.0, 6.6.1, 6.6.2


Yes, the web.conf file in $SPLUNK_HOME/etc/system/default/ is read-only and should not be modified. To set custom configurations, place a copy of web.conf in $SPLUNK_HOME/etc/system/local/ and modify that version. For examples of how to modify web.conf, see http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/Webconf#web.conf.example. For more information about configuration file directories, see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfiledirectories.

Andrewb splunk
October 13, 2014

the web.conf is read only, assuming that means 'Dont touch!'. Should that file be edited manually or is there a utility to change mgmtHostPort value?

October 11, 2014

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters