Archive

issue with Cluster Master pointing the HF to the Indexer Cluster

New Member

Hi All,

We have a situation where the Heavy Forwarder is deployed in the Client Site and the Indexer in our site. The IPs of the Indexers are “10.1.2.3” and “10.1.2.4”. The IP of the Cluster Master is “10.1.2.1”.

The HF reaches out to the Cluster Master on the IP “172.16.2.1”. This traffic gets natted and forwarded to “10.1.2.1”. The Cluster Master replies with the IPs of the Indexers.

Here is the problem, the Master is giving the HFs the actual IPs of the Indexers i.e. “10.1.2.3” and “10.1.2.4”. The HFs can never reach the Indexers on these IPs as there is natting in between which the Cluster Master is unaware of.

Is there a way to force the Cluster Master to reply to the HFs with the FQDNs of the Indexers rather than the IPs?

Thanks in advance for any help.

Best Regards,
Srivatsa G V

Tags (1)
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!