Hello,
currently I have 3 vms on the same data center same RHEL version and same splunk*.rpm installed on them, one is supposed to act as Master, a SH and an Indexer.
On the SH I get this on the Search Peer list:
The log in question has these interesting lines:
10.74.55.14 - - [08/Sep/2017:11:03:33.150 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
10.74.55.14 - - [08/Sep/2017:11:03:33.151 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
10.74.55.14 - - [08/Sep/2017:11:04:33.159 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
10.74.55.14 - - [08/Sep/2017:11:04:33.160 +0100] "??? / HTTP/1.0" 400 207 - - - 0ms
Here's My SH server.conf:
[general]
serverName = isearchhead
pass4SymmKey = REDACTED
[sslConfig]
sslPassword = REDACTED
enableSplunkdSSL = false
supportSSLV3Only = false
sslVerifyServerCert = false
[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial
[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder
[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free
[lmpool:auto_generated_pool_enterprise]
description = auto_generated_pool_enterprise
quota = MAX
slaves = *
stack_id = enterprise
[license]
active_group = Enterprise
[clustering]
master_uri = clustermaster:REDACTED:8089
mode = searchhead
[clustermaster:REDACTED:8089]
master_uri = http://REDACTED:8089
multisite = false
pass4SymmKey = REDACTED
site = default
~
And the distsearch.conf:
[distributedSearch]
servers = https://[Search Peer]:8089/
trySSLFirst = false #this was a shot in the dark for the 5 second thing
[general]
serverName = iindexer1
pass4SymmKey = REDACTED
[sslConfig]
sslPassword = REDACTED
enableSplunkdSSL = false
supportSSLV3Only = false
sslVerifyServerCert = false
[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial
[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder
[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free
[license]
master_uri = https://[SEARCH HEAD]:8089
[replication_port://9887]
on etc/auth/distServerKeys/isearchhead/trusted.pem of the Search Peer there's the file I pulled from SH according to instructions.
What am I missing here?
Thank you very much.
