Should register_search_address also be the address on which the master connects back to slaves?
according to documentation:
register_search_address = IP address, or fully qualified machine/domain name
* Only valid for mode=slave
* This is the address on which a slave will be available as search head.
This is useful in the cases where a splunk host machine has multiple
interfaces and only one of them can be reached by another splunkd instance.
However when I test it I see that the master is trying to connect back to slaves on actual source IP of the connection from the slave. If register_search_address is not the right config variable for master -> slave communication address, then which one is it?
Thank you!
Unfortunately, register_search_address does not work as expected, and the following bug has been filed for attention: SPL-83902.
This has been fixed and will be available in 6.2.4.
Please contact Support for a patch if you need a fix prior to the release of 6.2.4.