Deployment Architecture

How do I connect the indexer to the search head when the indexer does not have a public facing IP?

NJ
Path Finder

Hi all. 

Through my work I'm building a little distributed test environment. 

To make it extra hard on me they have setup the search head, indexer and forwarder on different v-Nets. Also, only the search head has a public IP.

My question then is how do I connect the indexer to the search head when the indexer does not have a public facing IP? 

 

Hope the question makes sense.

Jacob

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @NJ,

you need an internal or external ip, the only rule is that it must be reachable from the other machines to be connected.

In other words, internal or external isn't relevant, the only relevant thing is that Search Head and Forwarder must reach the Indexer IP: Forwarder on port 9997 (or another one if you changed the default), Search Head on ports: 9997 and 8089.

Ciao.

Giuseppe

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Firstly, you don't connect indexer to a search head. It's the other way around - you point the search head to a given indexer(s) so it knows where to dispatch the searches.

Secondly - as with any network connectivity - you just must have network communication from SH to idx. Whether you do it via means of public IP (which is inadvisable however if you were to set up your servers with interfaces facing the open internet) or private IP doesn't matter. You could even (provided you can meet the latency and throughput parameters) do it by means of VPN - why not.

With a relatively new Splunk release (9.0) you should also have properly set DNS, name-based connectivity and properly configured certificates with subject names matching the hostnames. But that's on another level.

gcusello
SplunkTrust
SplunkTrust

Hi @NJ,

even if your Indexer (and Forwarder) hasn't a public IP, it must have an IP, so you have to use it for connecting Forwarder and Search Head to it, obviously opening all the firewall routes between your machines.

Ciao.

Giuseppe

NJ
Path Finder

Hi @gcusello 

Yes I have internal Ip address for each of the machines but from most of the online videos I see people using the public ip address to link the machines instead of the internal ip address.

So how do I connect it using the internal ip address?

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @NJ,

you need an internal or external ip, the only rule is that it must be reachable from the other machines to be connected.

In other words, internal or external isn't relevant, the only relevant thing is that Search Head and Forwarder must reach the Indexer IP: Forwarder on port 9997 (or another one if you changed the default), Search Head on ports: 9997 and 8089.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...