Sidecar configuration settings

Explore the configuration settings and port allocation for Splunk sidecars.

You can access configuration settings for sidecars in configuration files.

Some sidecars are activated by default.

The following sections describe each sidecar, its process name, associated configuration file and stanza, default settings, and other configuration details.

Supervisor

  • Process name: splunk-supervisor

  • Associated stanza and configuration file: [teleport_supervisor] in server.conf

  • Default setting: disabled = false (activated)

SCIM

  • Process name: identity

  • Associated stanzas and configuration files:

    • [feature:identity_sidecar_scim] in web-features.conf

      Default setting: enabled = true (activated)

    • [<saml-authSettings-key>] in authentication.conf

      Default setting: scimEnabled = false (deactivated)

Storage

  • Process name: postgres

  • Associated stanza and configuration file: [postgres] in server.conf

  • Default setting:

    • Splunk Enterprise: disabled = false (activated)

    • Splunk Cloud Platform: disabled = true (deactivated)

Data Orchestration (DO)

  • Process name: cmp-orchestrator

  • Associated stanza and configuration file: Not configured in a .conf file

  • Default setting: activated

Edge Processor Control Plane

  • Process name: edge-processor-config

  • Associated stanza and configuration file: [data_management] in server.conf

  • Default setting: edge_processor_enabled = false (deactivated)

  • Availability:

    Available on Splunk Enterprise for single search heads.

    Note: For sidecars available on single search heads, ensure the enable_clustered_mode setting is set to false in the [postgres] stanza of server.conf.

  • Notes:

    Deactivated if Edge Processor is deactivated.

OpAmp

  • Process name: opamp-svc

  • Associated stanza and configuration file: [data_management] in server.conf

  • Default settings: edge_processor_enabled = false and otel_collector_management_enabled = false (deactivated)

  • Availability:

    Available on Splunk Enterprise with a single search head and single agent management.

    Note: For sidecars available on single search heads, ensure the enable_clustered_mode setting is set to false in the [postgres] stanza of server.conf.

  • Notes:

    The sidecar is activated if one of these settings has a value of true:

    • edge_processor_enabled

    • otel_collector_management_enabled

Agent Management

  • Process name: agent-manager

  • Associated configuration file: agent_management.conf

  • Default setting: activated.

IPC Broker

  • Process name: ipc_broker

  • Associated stanza and configuration file: [ipc_broker] in server.conf

  • Default setting: activated

  • Requirements:

    • Requires configuring the port on which IPC Broker waits for incoming requests.

      port = <integer>

      To assign a specific IPC address, for example, a port, to a sidecar, see Allocating a port by IPC Broker.

Spotlight

  • Process name: spotlight-collector

  • Associated stanza and configuration file: [teleport_supervisor] in server.conf

  • Default settings:

    • Splunk Enterprise: enable_splunk_spotlight = true (activated)

    • Splunk Cloud Platform: enable_splunk_spotlight = false (deactivated)

      Note: Although Spotlight is deactivated by default on Splunk Cloud Platform, the spotlight-collector process displays on the list of running processes.

Nascent

  • Process name: nascent

  • Associated stanza and configuration file: [cluster_state_server] in server.conf

  • Default settings:

    • Splunk Enterprise: disabled = false (activated)

    • Splunk Cloud Platform: disabled = true (deactivated)

  • Notes:

    By default, Nascent creates a backup of the etcd data every 5 minutes. It saves the backup in the snapshot file in the $SPLUNK_HOME/var/run/nascent/backup folder.

    To change the backup interval, edit the etcd_backup_interval setting in the [cluster_state_server] stanza of the server.conf file.

Allocating a port by IPC Broker

IPC Broker allocates the port for itself using a value in the [port] setting. If you want IPC Broker to always allocate a specific port to a sidecar, configure the following setting in the [ipc_broker] stanza in the server.conf file:

CODE 
<splunkd_helper_process_name>:<service_name>:address = <value>

where:

  • splunkd_helper_process_name is the process name of the sidecar. For process names of sidecars, see the Process name column in the Sidecar configuration settings table.

  • service_name is the name of a service exposed by a sidecar. Each sidecar can have any number of services. Each service has to have a unique name. IPC broker allocates a specific port to each service.

  • value is the IPC address, in this case a TCP/IP network port, that the sidecar service uses to serve incoming requests. The valid port range is from 1024 to 65535.

If this setting is not configured, then IPC Broker assigns a random available port to the sidecar.

In this example:

  • IPC Broker is allocated the port 8194 using the port setting.

  • Storage is allocated the ports 5432, 5433, 5434, 8008, 6432, 5435, 2380, and 2379 using the <splunkd_helper_process_name>:<service_name>:address settings.

CODE 
//server.conf

[ipc_broker]
port = 8194
postgres:postgres:address = 5432
postgres:postgres-primary:address = 5433
postgres:postgres-replica:address = 5434
postgres:patroni:address = 8008
postgres:pgbouncer:address = 6432
postgres:postgres_nanny:address = 5435 
nascent:etcd_peer:address = 2380
nascent:etcd_client:address = 2379

Check the range of sidecar ports

To check the range of ports that can be allocated to sidecars, use the sysctl utility on Linux. It is a command-line tool that you use to modify kernel parameters at runtime.
Enter the following query:
CODE 
sysctl net.ipv4.ip_local_port_range
This is an example result of the query. It indicates that sidecars are allocated pseudo-randomly to ports within the range of 32768 to 60999.
CODE 
net.ipv4.ip_local_port_range = 32768 60999

Deactivate a sidecar

If necessary, you can deactivate a sidecar by editing its settings directly in the configuration files. For information regarding the configuration file and stanza for each sidecar, see Sidecar configuration settings.

Note: Never change, copy, or move the configuration files that are in the default directory.

To change settings for a particular configuration file, follow these steps:

  1. Create a new version of the file in a non-default directory.
  2. Add the settings that you want to change. To learn how to edit the configuration files, see Edit the configuration file settings directly.