topic Re: How to configure a different replication port for each splunk instance on same unix instance? in Deployment Architecture

How to configure a different replication port for each splunk instance on same unix instance?

thirumalreddyb — Sun, 20 Aug 2017 15:53:09 GMT

I have an uncommon situation.

We have multiple Splunk instances on a single unix instance; two search heads, one deployer, and two indexers. The problem now is to setup a search head cluster.

Would someone please help with the configurations?

Thanks in advance.

Re: How to configure a different replication port for each splunk instance on same unix instance?

richgalloway — Sun, 20 Aug 2017 21:01:25 GMT

You need at least three search heads for a SH cluster.

Re: How to configure a different replication port for each splunk instance on same unix instance?

thirumalreddyb — Mon, 21 Aug 2017 01:56:14 GMT

Ok., increased to three.

Re: How to configure a different replication port for each splunk instance on same unix instance?

mdsnmss — Mon, 21 Aug 2017 13:31:14 GMT

We have a similar setup for our test environment. With three instances for the search heads you can configure each one's server.conf separately. There is a stanza in server.conf that applies when search head clustering is enabled. By default it is [replication_port://] with the port being 9000 I believe. You can change these to be different on each instance. Something like:

Instance 1:

[replication_port://9000]

Instance 2:

[replication_port://9100]

Instance 3:

[replication_port://9200]

Re: How to configure a different replication port for each splunk instance on same unix instance?

DalJeanis — Mon, 21 Aug 2017 13:37:23 GMT

@mdsnmss - I'm SO glad you said that. I was kind of going crosseyed at the OP's setup until you said, "test instance"...

Re: How to configure a different replication port for each splunk instance on same unix instance?

mdsnmss — Tue, 29 Sep 2020 15:28:02 GMT

When setting up your search head cluster you can specify ports during configuration as well:

./splunk init shcluster-config -mgmt_uri https://:8x89 -replication_port 9x00 -secret shcluster

You'll want a different management port for each one as well.

Re: How to configure a different replication port for each splunk instance on same unix instance?

mdsnmss — Mon, 21 Aug 2017 13:43:31 GMT

Yep, purely to test configurations. We have run into some issues while testing SSL from forwarder to indexer doing this however.

Re: How to configure a different replication port for each splunk instance on same unix instance?

thirumalreddyb — Mon, 21 Aug 2017 23:51:45 GMT

Yes, purely to test. Luckily Splunk + Linux is the best way to play around.

Re: How to configure a different replication port for each splunk instance on same unix instance?

arimaldo — Tue, 13 Oct 2020 19:17:55 GMT

Q: if there are more than 3 members, does the number of replication ports also increase - e.g. 4 members = 4 replication ports? What happens if you decide to just use the same port for all members?

Re: How to configure a different replication port for each splunk instance on same unix instance?

basant19 — Tue, 21 Jun 2022 06:46:02 GMT

As i tried this 9000 port in the peer side in the indexer, my indexer UI stuck please suggest.