Splunk Search

Distributed Search times out when trying to add a peer

yazapage
Explorer

I get the following error after I add a search peer - times out. The port is open in our firewall & sending to an internal search head.

ERROR KeyManagerLocalhost - Error while sending public key to search peer https://172.18.4
8.146:4351: Connect timed out.

Is there something other than port 4351 I need to set up somewhere? I can add a search peer within the firewall wtih no issues.

Tags (2)
0 Karma

yazapage
Explorer

Thanks - I believe we only have inbound traffic allowed. I will check with my firwall team to confirm

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I don't know what you mean when you say "sending to an internal search head", but that port is the port on the search peer/indexer, and as such, the firewall must allow TCP connections outbound from the search head to that port on the indexer. A timeout suggests that the firewall in fact is not allowing the required traffic.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...