I have recently configured a new Splunk Enterprise environment and I need to configure a search peer on my head instance. As i'm using puppet to configure all my instances, i'm doing this by adding the following to /opt/splunk/etc/system/local/distsearch.conf on the search head.
[distributedSearch]
servers=https://XXX.XX.XX.XX:8089
I'm also copying the trusted .pem file from the search head to the right folder on the peer. as per the documentation. I'm using our own IPA certificate to encrypt traffic between the instances. However after I restart Splunkd on both I get the following errors in the splunkd.log on the search head:
WARN DistributedPeer - Peer:https://XXX.XX.XX.XXX:8089 Unable to get server info from https://XXX.XX.XX.XXX:8089/services/server/info due to: Connect Timeout; exceeded 10000 milliseconds
WARN DistributedPeerManager - Cannot determine a latest common bundle, search may be blocked
WARN GetRemoteAuthToken - Unable to get auth token from peer: https://XXX.XX.XX.XXX:8089 due to: Connect Timeout; exceeded 5000 milliseconds
Sounds like a routing issue, however I can do an openssl s_client -connect from the search head to the peer on port 8089 and I can connect with no issues.
