Deployment Architecture

register_search_address and master -> slave communication

sbaryakov
Explorer

Should register_search_address also be the address on which the master connects back to slaves?

according to documentation:

register_search_address = IP address, or fully qualified machine/domain name

* Only valid for mode=slave
* This is the address on which a slave will be available as search head.
  This is useful in the cases where a splunk host machine has multiple 
  interfaces and only one of them can be reached by another splunkd instance.

However when I test it I see that the master is trying to connect back to slaves on actual source IP of the connection from the slave. If register_search_address is not the right config variable for master -> slave communication address, then which one is it?

Thank you!

Tags (3)

weeb
Splunk Employee
Splunk Employee

Unfortunately, register_search_address does not work as expected, and the following bug has been filed for attention: SPL-83902.

weeb
Splunk Employee
Splunk Employee

This has been fixed and will be available in 6.2.4.

Please contact Support for a patch if you need a fix prior to the release of 6.2.4.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...