Splunk Search

Issues configuring search peer

Stokers_23
Explorer

I have recently configured a new Splunk Enterprise environment and I need to configure a search peer on my head instance. As i'm using puppet to configure all my instances, i'm doing this by adding the following to /opt/splunk/etc/system/local/distsearch.conf on the search head.

[distributedSearch]
servers=https://XXX.XX.XX.XX:8089

I'm also copying the trusted .pem file from the search head to the right folder on the peer. as per the documentation. I'm using our own IPA certificate to encrypt traffic between the instances. However after I restart Splunkd on both I get the following errors in the splunkd.log on the search head:

WARN DistributedPeer - Peer:https://XXX.XX.XX.XXX:8089 Unable to get server info from https://XXX.XX.XX.XXX:8089/services/server/info due to: Connect Timeout; exceeded 10000 milliseconds
WARN DistributedPeerManager - Cannot determine a latest common bundle, search may be blocked
WARN GetRemoteAuthToken - Unable to get auth token from peer: https://XXX.XX.XX.XXX:8089 due to: Connect Timeout; exceeded 5000 milliseconds

Sounds like a routing issue, however I can do an openssl s_client -connect from the search head to the peer on port 8089 and I can connect with no issues.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

If you are following steps given here https://docs.splunk.com/Documentation/Splunk/7.2.6/DistSearch/Configuredistributedsearch#Edit_distse... then those trusted.pem and private.pem are public and private key files not Certificate.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...