Splunk's management and REST port — the admin plane, not the web UI.
splunkd listens on 8089 for the Splunk REST API and for management traffic between Splunk instances: deployment servers pushing apps, search heads talking to indexers, forwarders being managed. Splunk's own documentation gives 8089 as the default management/administration port. It speaks HTTPS with a self-signed certificate out of the box, and it is a separate port from Splunk Web on 8000 and from receiving on 9997. IANA leaves 8089 Unassigned.
Do not expose
This is the administrative API for the whole Splunk deployment; restrict it to management networks and replace the shipped default certificates.
$ curl -sk --max-time 5 https://TARGET:8089/services/server/infoSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.