Splunk Enterprise

How to configure two interfaces in splunk?

efaundez
Path Finder

Hello people, we are trying to set up a cluster using 2 differents interfaces where>
inteface A --> web access
interface B --> all the other communications

How can i do this? i have been trying to use SPLUNK_BINDIP with mngmtHostPort but it doesnt work at all

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

The cherryPy web server IP can be configured in ../etc/system/local/web.conf using server.socket_host, it binds to 0.0.0.0 by default.

If you set SPLUNK_BINDIP in splunk-launch.conf, you also need to change mgmtHostPort in web.conf to the the same IP address:port (it defaults to localhost).

This is documented here.

You may also want to consider using one interface for intra-cluster replication traffic instead of separating web from everything else, but without understanding your goals, I may be off-target.

0 Karma

efaundez
Path Finder

Good afternoon

Thanks for your answer, indeed I want to separate that the access via web through port: 8000 is only through one interface and to be able to configure the second interface for replication and communication of the cluster.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Replication traffic is controlled separately on cluster peers using

register_replication_address

in server.conf

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...