Deployment Architecture

register_search_address and master -> slave communication


Should register_search_address also be the address on which the master connects back to slaves?

according to documentation:

register_search_address = IP address, or fully qualified machine/domain name

* Only valid for mode=slave
* This is the address on which a slave will be available as search head.
  This is useful in the cases where a splunk host machine has multiple 
  interfaces and only one of them can be reached by another splunkd instance.

However when I test it I see that the master is trying to connect back to slaves on actual source IP of the connection from the slave. If register_search_address is not the right config variable for master -> slave communication address, then which one is it?

Thank you!

Tags (3)

Splunk Employee
Splunk Employee

Unfortunately, register_search_address does not work as expected, and the following bug has been filed for attention: SPL-83902.

Splunk Employee
Splunk Employee

This has been fixed and will be available in 6.2.4.

Please contact Support for a patch if you need a fix prior to the release of 6.2.4.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>