Splunk Search

Distributed Search times out when trying to add a peer

yazapage
Explorer

I get the following error after I add a search peer - times out. The port is open in our firewall & sending to an internal search head.

ERROR KeyManagerLocalhost - Error while sending public key to search peer https://172.18.4
8.146:4351: Connect timed out.

Is there something other than port 4351 I need to set up somewhere? I can add a search peer within the firewall wtih no issues.

Tags (2)
0 Karma

yazapage
Explorer

Thanks - I believe we only have inbound traffic allowed. I will check with my firwall team to confirm

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I don't know what you mean when you say "sending to an internal search head", but that port is the port on the search peer/indexer, and as such, the firewall must allow TCP connections outbound from the search head to that port on the indexer. A timeout suggests that the firewall in fact is not allowing the required traffic.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...