Splunk Enterprise

How to configure two interfaces in splunk?

efaundez
Path Finder

Hello people, we are trying to set up a cluster using 2 differents interfaces where>
inteface A --> web access
interface B --> all the other communications

How can i do this? i have been trying to use SPLUNK_BINDIP with mngmtHostPort but it doesnt work at all

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

The cherryPy web server IP can be configured in ../etc/system/local/web.conf using server.socket_host, it binds to 0.0.0.0 by default.

If you set SPLUNK_BINDIP in splunk-launch.conf, you also need to change mgmtHostPort in web.conf to the the same IP address:port (it defaults to localhost).

This is documented here.

You may also want to consider using one interface for intra-cluster replication traffic instead of separating web from everything else, but without understanding your goals, I may be off-target.

0 Karma

efaundez
Path Finder

Good afternoon

Thanks for your answer, indeed I want to separate that the access via web through port: 8000 is only through one interface and to be able to configure the second interface for replication and communication of the cluster.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Replication traffic is controlled separately on cluster peers using

register_replication_address

in server.conf

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...