topic Re: BIND IP Causing issues with RTSearch... in Getting Data In

BIND IP Causing issues with RTSearch...

balbano — Tue, 06 Jul 2010 22:12:56 GMT

We have done an interface binding (to IP: index1_IP) on one of our indexers.

This was done on one of the indexer (indexer1) as testing:

etc/splunk-launch.conf:

SPLUNK_BINDIP=index1_IP

etc/system/local/web.conf:

mgmtHostPort = index1_IP:8089

Afterward, we noticed an issue with the live-tail feature on both the search head and indexer:

search head:

[index1] Streamed search execute failed because: Error in 'RealTimeSearch': Failed to connect with url 'https://127.0.0.1:8089/services/streams/rtsearch' because of Encountered a connection error for host 127.0.0.1:8089\n..

from index1:

Failed to create result provider for remote peer 'index1' at uri '' with the stream 'rtlitsearch ( host=arg1* OR host=arg2* ) arg3 | fields keepcolorder=t * "*" "host" "index" "source" "sourcetype" "splunk_server"'.

It seems from the error displayed on the search head that it's not tailing the indexer by the correct IP.

Are we missing more parameter in some conf files in order to bind to the IP successfully?

Let me know if you guys need any further info.

Just FYI that we have an open support case for this but we have not heard back from Splunk Support so I am trying Splunk Answers since you guys are always fast and helpful.

Thanks.

Brian

Re: BIND IP Causing issues with RTSearch...

Paolo_Prigione — Wed, 07 Jul 2010 19:20:42 GMT

Hi, have you tried this stanza configuration in the etc/system/local/server.conf file?

[httpServerListener:index1_IP:8089]
ssl = true

Re: BIND IP Causing issues with RTSearch...

balbano — Wed, 07 Jul 2010 22:05:39 GMT

This did not resolve the issue.

Re: BIND IP Causing issues with RTSearch...

balbano — Wed, 07 Jul 2010 23:36:03 GMT

As a workaround until someone can shed some light on this, we have done the following:

Installed rinetd in order to do port forwarding from 127.0.0.1:8089--->index1_IP:8089...

This seems to have fixed the problem until we hear from anyone here or from the support engineers.

Brian

Re: BIND IP Causing issues with RTSearch...

matt — Thu, 08 Jul 2010 01:03:59 GMT

The two functions (BINDIP and Real-time search) do not play well with each other. This is being tracked as SPL-32549 and we hope to have it addressed in an upcoming maintenance release