Deployment Architecture

register_search_address and master -> slave communication

sbaryakov
Explorer

Should register_search_address also be the address on which the master connects back to slaves?

according to documentation:

register_search_address = IP address, or fully qualified machine/domain name

* Only valid for mode=slave
* This is the address on which a slave will be available as search head.
  This is useful in the cases where a splunk host machine has multiple 
  interfaces and only one of them can be reached by another splunkd instance.

However when I test it I see that the master is trying to connect back to slaves on actual source IP of the connection from the slave. If register_search_address is not the right config variable for master -> slave communication address, then which one is it?

Thank you!

Tags (3)

weeb
Splunk Employee
Splunk Employee

Unfortunately, register_search_address does not work as expected, and the following bug has been filed for attention: SPL-83902.

weeb
Splunk Employee
Splunk Employee

This has been fixed and will be available in 6.2.4.

Please contact Support for a patch if you need a fix prior to the release of 6.2.4.

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...