Splunk Search

Distributed Search times out when trying to add a peer

yazapage
Explorer

I get the following error after I add a search peer - times out. The port is open in our firewall & sending to an internal search head.

ERROR KeyManagerLocalhost - Error while sending public key to search peer https://172.18.4
8.146:4351: Connect timed out.

Is there something other than port 4351 I need to set up somewhere? I can add a search peer within the firewall wtih no issues.

Tags (2)
0 Karma

yazapage
Explorer

Thanks - I believe we only have inbound traffic allowed. I will check with my firwall team to confirm

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I don't know what you mean when you say "sending to an internal search head", but that port is the port on the search peer/indexer, and as such, the firewall must allow TCP connections outbound from the search head to that port on the indexer. A timeout suggests that the firewall in fact is not allowing the required traffic.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...