I have a Splunk instance where I do not need the web services. How can I disable the internal Splunk web server from running?
asked 15 Jan '10, 02:03
You can do this via manager.
Login to splunkweb and click on Manager. From the Manager homepage, click on system settings, then general settings.
Under the splunk web section of that form, there are three options, one of them being the one you want.
Splunk Web Run Splunk Web Yes No
Just change Run Splunk Web to No, and submit the form, you will need to restart and after that you will no longer have a splunkweb front end running on your server.
You can also do this via the cli with: ./splunk disable webserver, then restart splunk and it disabled.
To turn this back on, you won't be able to do this via splunkweb (since you just turned splunkweb off) you will need to use the following cli command:
./splunk enable webserver, then restart splunk and it will be back up.
answered 15 Jan '10, 02:10
On Windows, splunkweb is also a formally defined service. You can stop it from running and/or starting from the service manager UI (Admin tools -> Services or right-click on My Computer).
Or you can use the CLI tool 'sc' (e.g. 'sc stop splunkweb' or 'sc config splunkweb start= disabled' (the space is required after '='))
answered 15 Jan '10, 17:34
./splunk disable webserver
./splunk enable webserver
easy and fast!
answered 26 May '10, 12:34
You should also be able to set this in the web.conf file with the following:
answered 05 Apr '12, 13:25