Splunk Enterprise

ERROR DistributedPeerManagerHeartbeat [xxxxx DistributedPeerMonitorThread] - Status 502 while sending public key to clus

hrawat_splunk
Splunk Employee
Splunk Employee

Why I am getting the ERROR with Splunk 9.x


Labels (1)
Tags (1)
0 Karma
1 Solution

hrawat_splunk
Splunk Employee
Splunk Employee
New behavior to kill DNS lookup traffic, by default searches use https://<ip>:<port> instead of https://<FQDN hostname>:<port>
To revert back to previous behavior of <hostname:port>, there is a config for 9.0.x.
distsearch.conf
[distributedSearch]
useIPAddrAsHost=false
For future releases, if sslVerifyServerName=true , then automatically useIPAddrAsHost=false

View solution in original post

0 Karma

hrawat_splunk
Splunk Employee
Splunk Employee
New behavior to kill DNS lookup traffic, by default searches use https://<ip>:<port> instead of https://<FQDN hostname>:<port>
To revert back to previous behavior of <hostname:port>, there is a config for 9.0.x.
distsearch.conf
[distributedSearch]
useIPAddrAsHost=false
For future releases, if sslVerifyServerName=true , then automatically useIPAddrAsHost=false
0 Karma

keithevanscdcr
Explorer

Are you sure about one sslVerifyServerName = true automatically sets useIPAddressAsHost = false.

On the server sslVerifyServerName is the Splunk search head communicating to the indexers for distributed search, the sslVerifyServerName is asking for the certificate CN or SAN to match the server name returned.  It's the Indexer that has to respond to the search with it's server name and not IP.  

Seems like these two attributes should be on separate hosts.

I am trying to understand as well, but I don't.  Right now we're on 9.0.2 and I'm now getting the below error when using this attribute, where I didn't before:

 - Invalid key in stanza [distributedSearch] in /opt/splunk/etc/system/local/distsearch.conf, line 2: useIPAddrAsHost (value: false).

 

Thanks much in advance.

0 Karma

hrawat_splunk
Splunk Employee
Splunk Employee

> Invalid key in stanza [distributedSearch] in /opt/splunk/etc/system/local/distsearch.conf, line 2: useIPAddrAsHost (value: false).

You get above messages because `useIPAddrAsHost` is not part of the distsearch.conf.spec file. Apart from above message, it works. 

>Are you sure about one sslVerifyServerName = true automatically sets useIPAddressAsHost = false.
From 9.1 onwards.

0 Karma

keithevanscdcr
Explorer

Thank you for the clarification.  

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...