Deployment Architecture

register_search_address and master -> slave communication


Should register_search_address also be the address on which the master connects back to slaves?

according to documentation:

register_search_address = IP address, or fully qualified machine/domain name

* Only valid for mode=slave
* This is the address on which a slave will be available as search head.
  This is useful in the cases where a splunk host machine has multiple 
  interfaces and only one of them can be reached by another splunkd instance.

However when I test it I see that the master is trying to connect back to slaves on actual source IP of the connection from the slave. If register_search_address is not the right config variable for master -> slave communication address, then which one is it?

Thank you!

Tags (3)

Splunk Employee
Splunk Employee

Unfortunately, register_search_address does not work as expected, and the following bug has been filed for attention: SPL-83902.

Splunk Employee
Splunk Employee

This has been fixed and will be available in 6.2.4.

Please contact Support for a patch if you need a fix prior to the release of 6.2.4.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!