Default port: 8089
PORT STATE SERVICE VERSION8089/tcp open http Splunkd httpd
In the following page you can find an explanation how this service can be abused to escalate privileges and obtain persistence:
Splunk build