How do I connect the indexer to the search head when the indexer does not have a public facing IP?

[NJ]

Hi all. 

Through my work I'm building a little distributed test environment. 

To make it extra hard on me they have setup the search head, indexer and forwarder on different v-Nets. Also, only the search head has a public IP.

My question then is how do I connect the indexer to the search head when the indexer does not have a public facing IP? 

Hope the question makes sense.

Jacob

[PickleRick]

Firstly, you don't connect indexer to a search head. It's the other way around - you point the search head to a given indexer(s) so it knows where to dispatch the searches.

Secondly - as with any network connectivity - you just must have network communication from SH to idx. Whether you do it via means of public IP (which is inadvisable however if you were to set up your servers with interfaces facing the open internet) or private IP doesn't matter. You could even (provided you can meet the latency and throughput parameters) do it by means of VPN - why not.

With a relatively new Splunk release (9.0) you should also have properly set DNS, name-based connectivity and properly configured certificates with subject names matching the hostnames. But that's on another level.

[gcusello]

Hi @NJ,

even if your Indexer (and Forwarder) hasn't a public IP, it must have an IP, so you have to use it for connecting Forwarder and Search Head to it, obviously opening all the firewall routes between your machines.

Ciao.

Giuseppe

[NJ]

Hi @gcusello 

Yes I have internal Ip address for each of the machines but from most of the online videos I see people using the public ip address to link the machines instead of the internal ip address.

So how do I connect it using the internal ip address?

[gcusello · Accepted solution]

Hi @NJ,

you need an internal or external ip, the only rule is that it must be reachable from the other machines to be connected.

In other words, internal or external isn't relevant, the only relevant thing is that Search Head and Forwarder must reach the Indexer IP: Forwarder on port 9997 (or another one if you changed the default), Search Head on ports: 9997 and 8089.

Ciao.

Giuseppe