Splunk Enterprise

How to configure two interfaces in splunk?

efaundez
Path Finder

Hello people, we are trying to set up a cluster using 2 differents interfaces where>
inteface A --> web access
interface B --> all the other communications

How can i do this? i have been trying to use SPLUNK_BINDIP with mngmtHostPort but it doesnt work at all

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

The cherryPy web server IP can be configured in ../etc/system/local/web.conf using server.socket_host, it binds to 0.0.0.0 by default.

If you set SPLUNK_BINDIP in splunk-launch.conf, you also need to change mgmtHostPort in web.conf to the the same IP address:port (it defaults to localhost).

This is documented here.

You may also want to consider using one interface for intra-cluster replication traffic instead of separating web from everything else, but without understanding your goals, I may be off-target.

0 Karma

efaundez
Path Finder

Good afternoon

Thanks for your answer, indeed I want to separate that the access via web through port: 8000 is only through one interface and to be able to configure the second interface for replication and communication of the cluster.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Replication traffic is controlled separately on cluster peers using

register_replication_address

in server.conf

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!