Splunk Enterprise

How to configure two interfaces in splunk?

efaundez
Path Finder

Hello people, we are trying to set up a cluster using 2 differents interfaces where>
inteface A --> web access
interface B --> all the other communications

How can i do this? i have been trying to use SPLUNK_BINDIP with mngmtHostPort but it doesnt work at all

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

The cherryPy web server IP can be configured in ../etc/system/local/web.conf using server.socket_host, it binds to 0.0.0.0 by default.

If you set SPLUNK_BINDIP in splunk-launch.conf, you also need to change mgmtHostPort in web.conf to the the same IP address:port (it defaults to localhost).

This is documented here.

You may also want to consider using one interface for intra-cluster replication traffic instead of separating web from everything else, but without understanding your goals, I may be off-target.

0 Karma

efaundez
Path Finder

Good afternoon

Thanks for your answer, indeed I want to separate that the access via web through port: 8000 is only through one interface and to be able to configure the second interface for replication and communication of the cluster.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Replication traffic is controlled separately on cluster peers using

register_replication_address

in server.conf

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...