Deployment Architecture

Unable to bind Search Head with indexer

dhamumarch03
New Member

Am learning Splunk Admin,
I am trying to bind search head with indexer, while configuring am getting error saying "Encountered the following error while trying to save: Error while sending public key to search peer: Connect Timeout".

I have created 3 AWS EC2 instances.
1 instance with UF installed with port 8089 opened ---App Server (Created inputs.conf & outputs.conf)
1 Instance with full package installed with ports 8000,8080,9997 --Indexer (configured Receiving port 9997)
1 Instance with full package installed with ports 8000,8080,9997 --Search Head (configured Receiving port 9997).

From Indexer I am able to pull the data from the App server, but unable to bind the Search Head with Indexer.

please help me.

//Dhamodaram

Tags (1)
0 Karma

woodcock
Esteemed Legend

Do this:
1: The Search Head does not receive so turn off port 9997.
2: The UF does not need admin, so turn off port 8089.
3: The indexers receive searches from the Search Head on port 8089 so turn that on for the Indexers.

0 Karma

dhamumarch03
New Member

Hi Woodcock,

Thanks for your help.

//Dhamodaram

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept to close the question if it worked.

0 Karma