Getting Data In

BIND IP Causing issues with RTSearch...

balbano
Contributor

We have done an interface binding (to IP: index1_IP) on one of our indexers.

This was done on one of the indexer (indexer1) as testing:

etc/splunk-launch.conf:

SPLUNK_BINDIP=index1_IP

etc/system/local/web.conf:

mgmtHostPort = index1_IP:8089

Afterward, we noticed an issue with the live-tail feature on both the search head and indexer:

search head:

[index1] Streamed search execute failed because: Error in 'RealTimeSearch': Failed to connect with url 'https://127.0.0.1:8089/services/streams/rtsearch' because of Encountered a connection error for host 127.0.0.1:8089\n..

from index1:

Failed to create result provider for remote peer 'index1' at uri '' with the stream 'rtlitsearch ( host=arg1* OR host=arg2* ) arg3 | fields keepcolorder=t * "*" "host" "index" "source" "sourcetype" "splunk_server"'.

It seems from the error displayed on the search head that it's not tailing the indexer by the correct IP.

Are we missing more parameter in some conf files in order to bind to the IP successfully?

Let me know if you guys need any further info.

Just FYI that we have an open support case for this but we have not heard back from Splunk Support so I am trying Splunk Answers since you guys are always fast and helpful.

Thanks.

Brian

0 Karma
1 Solution

balbano
Contributor

As a workaround until someone can shed some light on this, we have done the following:

  • Installed rinetd in order to do port forwarding from 127.0.0.1:8089--->index1_IP:8089...

This seems to have fixed the problem until we hear from anyone here or from the support engineers.

Brian

View solution in original post

0 Karma

matt
Splunk Employee
Splunk Employee

The two functions (BINDIP and Real-time search) do not play well with each other. This is being tracked as SPL-32549 and we hope to have it addressed in an upcoming maintenance release

0 Karma

balbano
Contributor

As a workaround until someone can shed some light on this, we have done the following:

  • Installed rinetd in order to do port forwarding from 127.0.0.1:8089--->index1_IP:8089...

This seems to have fixed the problem until we hear from anyone here or from the support engineers.

Brian

0 Karma

Paolo_Prigione
Builder

Hi, have you tried this stanza configuration in the etc/system/local/server.conf file?

[httpServerListener:index1_IP:8089]
ssl = true
0 Karma

balbano
Contributor

This did not resolve the issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...