Deployment Architecture

Unable to bind Search Head with indexer

dhamumarch03
New Member

Am learning Splunk Admin,
I am trying to bind search head with indexer, while configuring am getting error saying "Encountered the following error while trying to save: Error while sending public key to search peer: Connect Timeout".

I have created 3 AWS EC2 instances.
1 instance with UF installed with port 8089 opened ---App Server (Created inputs.conf & outputs.conf)
1 Instance with full package installed with ports 8000,8080,9997 --Indexer (configured Receiving port 9997)
1 Instance with full package installed with ports 8000,8080,9997 --Search Head (configured Receiving port 9997).

From Indexer I am able to pull the data from the App server, but unable to bind the Search Head with Indexer.

please help me.

//Dhamodaram

Tags (1)
0 Karma

woodcock
Esteemed Legend

Do this:
1: The Search Head does not receive so turn off port 9997.
2: The UF does not need admin, so turn off port 8089.
3: The indexers receive searches from the Search Head on port 8089 so turn that on for the Indexers.

0 Karma

dhamumarch03
New Member

Hi Woodcock,

Thanks for your help.

//Dhamodaram

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept to close the question if it worked.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...