Splunk Forwarder Port Binding

If your deploying the Splunk Forwarder to send event logs to your Splunk servers, you may or may not know that it doesn't just grab your logs and send them off.  Binds to a port for some reason.  By default it grabs 8089.

If you're in a decent sized environment, which if you can afford Splunk I assume you are, then you will probably find at least 1 existing app that is already using that port and that's where this post comes in.

The problem will present itself by you trying to start the Splunk service and the Splunk service telling you, "nope I am not starting."

First thing to check is the log file.  This can be found in the install directory under the var\log\splunk subfolders.  By default, the full path will be c:\program files\SplunkUniversalForwarder\var\log\splunk.



Once you're here, open up the splunkd.log file.  Scroll through for something listed as FATAL.  In our case, that shows HTTPServer - Could not bind to port 8089.  Now if you're feeling uber thorough, you can go check the bindings in IIS to see what is taking using that port, assuming it's a website that's already taking the port of course.



Now that we have confirmed the port is the problem, lets change splunk to use a different port.  To do this, we modify the web.conf files which by default is located in c:\program files\SplunkUniversalForwarder\etc\system\default.


Open up hte web.conf file and find the mgmtHostPort entry.  Easiest way of doing it would be to just search for 8089.


Once you have tracked that line down, just change the port number to what ever you want it to be and save the file.


Go back and try starting the service again.  You should now have a working forwarder happily sending data to your Splunk server for analysis.


As with anything you find on the Internet use this at your own risk.  Just because it worked for me doesn't mean it will work for you.

Comments

Popular posts from this blog

Local Administrator Password Solution(LAPS)

Error Connecting to Hyper-V Host

MBAM Not BitLocking