Deployment Architecture
Highlighted

Can I specify a dedicated network for cluster replication transport in a clustered environment?

Motivator

Hi

In a clustered environment, network for replication needs to be fast.
I have multiple network interfaces in a peer server and I want to tell Splunk to use a specific interface for data replication.

Has anyone here done this?
Thank you very much in advance.

Labels (1)
Highlighted

Re: Can I specify a dedicated network for cluster replication transport in a clustered environment?

Builder

I've asked a similar question before for a multi-tenant environment and I think the same solution should work. This option in server.conf on the peer should do the trick:

register_replication_address = <IP address, or fully qualified machine/domain name>
    * Only valid for mode=slave
    * This is the address on which a slave will be available for accepting
      replication data. This is useful in the cases where a slave host machine 
      has multiple interfaces and only one of them can be reached by another 
      splunkd instance

Documentation: server.conf

Hope this helps, good luck!!

View solution in original post

Highlighted

Re: Can I specify a dedicated network for cluster replication transport in a clustered environment?

Motivator

Thank you for the information!

0 Karma
Highlighted

Re: Can I specify a dedicated network for cluster replication transport in a clustered environment?

Path Finder

I know this is is an old answer but have you tried this out? I am getting "invalid hostname" when trying to use registerreplicationaddress..and yes the peer and CM can reach each other and even resolve. Also im using IP for testing.

0 Karma
Highlighted

Re: Can I specify a dedicated network for cluster replication transport in a clustered environment?

Explorer

I believe you will likely want to configure "registerforwarderaddress" and "registersearchaddress" as well. I've heard of situations where a cluster was attempting to use the interface identified by the "registerreplicationaddress" to also perform searches and receive ingest. It is probably best that if you configure one of these stanzas that you do the other two as well.

registerforwarderaddress =
* Only valid for mode=slave
* This is the address on which a slave will be available for accepting
data from forwarder.This is useful in the cases where a splunk host
machine has multiple interfaces and only one of them can be reached by
another splunkd instance.

registersearchaddress =
* Only valid for mode=slave
* This is the address on which a slave will be available as search head.
This is useful in the cases where a splunk host machine has multiple
interfaces and only one of them can be reached by another splunkd
instance.

0 Karma