BIND IP Causing issues with RTSearch...

[balbano]

We have done an interface binding (to IP: index1_IP) on one of our indexers.

This was done on one of the indexer (indexer1) as testing:

etc/splunk-launch.conf:

SPLUNK_BINDIP=index1_IP

etc/system/local/web.conf:

mgmtHostPort = index1_IP:8089

Afterward, we noticed an issue with the live-tail feature on both the search head and indexer:

search head:

[index1] Streamed search execute failed because: Error in 'RealTimeSearch': Failed to connect with url 'https://127.0.0.1:8089/services/streams/rtsearch' because of Encountered a connection error for host 127.0.0.1:8089\n..

from index1:

Failed to create result provider for remote peer 'index1' at uri '' with the stream 'rtlitsearch ( host=arg1* OR host=arg2* ) arg3 | fields keepcolorder=t * "*" "host" "index" "source" "sourcetype" "splunk_server"'.

It seems from the error displayed on the search head that it's not tailing the indexer by the correct IP.

Are we missing more parameter in some conf files in order to bind to the IP successfully?

Let me know if you guys need any further info.

Just FYI that we have an open support case for this but we have not heard back from Splunk Support so I am trying Splunk Answers since you guys are always fast and helpful.

Thanks.

Brian

[matt]

The two functions (BINDIP and Real-time search) do not play well with each other. This is being tracked as SPL-32549 and we hope to have it addressed in an upcoming maintenance release

[balbano · Accepted solution]

As a workaround until someone can shed some light on this, we have done the following:

• Installed rinetd in order to do port forwarding from 127.0.0.1:8089--->index1_IP:8089...

This seems to have fixed the problem until we hear from anyone here or from the support engineers.

Brian

[Paolo_Prigione]

Hi, have you tried this stanza configuration in the etc/system/local/server.conf file?

[httpServerListener:index1_IP:8089]
ssl = true

[balbano]

This did not resolve the issue.