Splunk Enterprise

ERROR DistributedPeerManagerHeartbeat [xxxxx DistributedPeerMonitorThread] - Status 502 while sending public key to clus

hrawat_splunk
Splunk Employee
Splunk Employee

Why I am getting the ERROR with Splunk 9.x


Labels (1)
Tags (1)
0 Karma
1 Solution

hrawat_splunk
Splunk Employee
Splunk Employee
New behavior to kill DNS lookup traffic, by default searches use https://<ip>:<port> instead of https://<FQDN hostname>:<port>
To revert back to previous behavior of <hostname:port>, there is a config for 9.0.x.
distsearch.conf
[distributedSearch]
useIPAddrAsHost=false
For future releases, if sslVerifyServerName=true , then automatically useIPAddrAsHost=false

View solution in original post

0 Karma

hrawat_splunk
Splunk Employee
Splunk Employee
New behavior to kill DNS lookup traffic, by default searches use https://<ip>:<port> instead of https://<FQDN hostname>:<port>
To revert back to previous behavior of <hostname:port>, there is a config for 9.0.x.
distsearch.conf
[distributedSearch]
useIPAddrAsHost=false
For future releases, if sslVerifyServerName=true , then automatically useIPAddrAsHost=false
0 Karma

keithevanscdcr
Explorer

Are you sure about one sslVerifyServerName = true automatically sets useIPAddressAsHost = false.

On the server sslVerifyServerName is the Splunk search head communicating to the indexers for distributed search, the sslVerifyServerName is asking for the certificate CN or SAN to match the server name returned.  It's the Indexer that has to respond to the search with it's server name and not IP.  

Seems like these two attributes should be on separate hosts.

I am trying to understand as well, but I don't.  Right now we're on 9.0.2 and I'm now getting the below error when using this attribute, where I didn't before:

 - Invalid key in stanza [distributedSearch] in /opt/splunk/etc/system/local/distsearch.conf, line 2: useIPAddrAsHost (value: false).

 

Thanks much in advance.

0 Karma

hrawat_splunk
Splunk Employee
Splunk Employee

> Invalid key in stanza [distributedSearch] in /opt/splunk/etc/system/local/distsearch.conf, line 2: useIPAddrAsHost (value: false).

You get above messages because `useIPAddrAsHost` is not part of the distsearch.conf.spec file. Apart from above message, it works. 

>Are you sure about one sslVerifyServerName = true automatically sets useIPAddressAsHost = false.
From 9.1 onwards.

0 Karma

keithevanscdcr
Explorer

Thank you for the clarification.  

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...