Getting Data In

Why am I getting "Error while sending public key to search peer: Connection reset by peer"?

amirzargaran
New Member

I have a Splunk Server on Ubuntu and a Splunkforwarder on Ubuntu too.
I want to add splunkforwarder to distributed search on Splunk server, but when try to add it, the error below is generated:

Encountered the following error while trying to save: In handler 'distsearch-peer': Error while sending public key to search peer: Connection reset by peer

How do can I fix this problem?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Check out the local instances splunkd.log. It's possible a universal forwarder can't be added as a search peer since its not capable of handling searches. Otherwise it could simply be a permissions issue since the user must be an admin on both systems.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...