Configure Splunk instance with 2 IP addresses ?

[sieutruc]

Hello Splunkers,

I have a Splunk server configured with 2 interfaces (178.17.0.80, 192.168.194.80, hostname=searchhead).In splunklaunch.conf, i bind Splunk's IP to 178.17.0.80.
I can connect to Splunk inside network 178.17.0.0, but not in network 192.168.194.0. This Splunk machine has name server configured from DNS server of each network to make sure the hostname "searchhead" be resolved to the correct ip address.
So my question is how to connect to Splunk web from 2 networks that uses only common hostname "searchhead" ?

[bmacias84]

Alternatively you could use use port fowarding using iptables or netsh depending on platform.

#Linux

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 8000 -j DNAT --to 192.168.194.80:8000

iptables -A FORWARD -p tcp -d 192.168.194.80 --dport 8000 -j ACCEPT

#Windows

netsh interface portproxy add v4tov4 listenport=8000 listenaddress=192.168.194.80 connectport=8000 connectaddress=178.17.0.80

Netsh_PortProxy

iptables

Hope this helps or gets you started.
Cheers,

[MuS · Accepted solution]

hi sieutruc

sounds more like a routing problem, if you bind splunk to IP 178.17.0.80 you must have a network route to reach it from inside 192.168.194.0.

are you able to do the following:

• 'ping searchhead' from inside 192.168.194.0, it resolves to the correct IP and you get an answer?
• are you able to open the splunk web page on http://178.17.0.80:<yourport>; from inside 192.168.194.0?

update:
why don't you unset the SPLUNK_BINDIP option so it binds to '*' ?

 SPLUNK_BINDIP=<ip address>
 * If unset, Splunk makes no specific request operating system when binding to
 ports/opening a listening socket.  This means it effectively binds to '*' or
 an unspecified bind.  The exact result of this is contolled by operating
 system behavior and configuration.

cheers,

MuS

[sieutruc]

I haven't solved it yet.I will try SPLUNK_BINDIP=* tomorrow, but for the security reason, 2 domains with separate sub-network cannot connect together, so if iam in 192.168.194.0, searchhead is resolved to 192.168.194.80. And i can't open the splunk web page on http://178.17.0.80: from inside 192.168.194.0.
The thing i want is to connect splunk web page with the hostname, no matter what source it's from.