ERROR DistributedPeerManagerHeartbeat [xxxxx DistributedPeerMonitorThread] - Status 502 while sending public key to clus

[hrawat]

Why I am getting the ERROR with Splunk 9.x

[hrawat · Accepted solution]

New behavior to kill DNS lookup traffic, by default searches use https://<ip>:<port> instead of https://<FQDN hostname>:<port>
To revert back to previous behavior of <hostname:port>, there is a config for 9.0.x.

distsearch.conf
[distributedSearch]
useIPAddrAsHost=false

For future releases, if sslVerifyServerName=true , then automatically useIPAddrAsHost=false

[keithevanscdcr]

Are you sure about one sslVerifyServerName = true automatically sets useIPAddressAsHost = false.

On the server sslVerifyServerName is the Splunk search head communicating to the indexers for distributed search, the sslVerifyServerName is asking for the certificate CN or SAN to match the server name returned.  It's the Indexer that has to respond to the search with it's server name and not IP.  

Seems like these two attributes should be on separate hosts.

I am trying to understand as well, but I don't.  Right now we're on 9.0.2 and I'm now getting the below error when using this attribute, where I didn't before:

 - Invalid key in stanza [distributedSearch] in /opt/splunk/etc/system/local/distsearch.conf, line 2: useIPAddrAsHost (value: false).

Thanks much in advance.

[hrawat]

> Invalid key in stanza [distributedSearch] in /opt/splunk/etc/system/local/distsearch.conf, line 2: useIPAddrAsHost (value: false).

You get above messages because `useIPAddrAsHost` is not part of the distsearch.conf.spec file. Apart from above message, it works. 

>Are you sure about one sslVerifyServerName = true automatically sets useIPAddressAsHost = false.
From 9.1 onwards.

[keithevanscdcr]

Thank you for the clarification.