Getting Data In

Heavy forwarder with 2nics not communicating on 8089

Path Finder

I have a heavy forwarder running 6.4.1 on CentOS 7 with 2 nics on seperate subnets (data and mgt) that won't communicate on port 8089.

In a netstat I can see that 8089 is listening but no comms.

When I disable one of the interface, everything works fine.

Any ideas?

0 Karma

Communicator

Guessing that splunk is confused about what IP it should be using. I would try setting the IP for interface that you want use by setting SPLUNK_BINDIP= in the splunk-launch.conf.
Note that this conf file is not in apps but rather $SPLUNK_HOME/etc/splunk-launch.conf.
Double check the spec, http://docs.splunk.com/Documentation/Splunk/latest/Admin/Splunk-launchconf, for syntax.
Hope this helps!

0 Karma

Path Finder

this will bind both 8089, 9997 AND web to that interface right? Web needs to be separated to mgt and not on data otherwise it defeats the purpose of segmentaton

0 Karma

Communicator

right, sorry.
Have you tried setting mgmtHostPort in web.conf?

0 Karma

Path Finder

mgmtHostPort is set to localhost on port 8089

0 Karma

Path Finder

never mind SElinux,....

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!