Hey everyone. I am trying to bind the forwarding service to a particular IP because one of the boxes we are using as a source is multihomed. First, is this possible? Second, how would I go about doing it? The hosts in question run on both Solaris and Linux.
For binding the listening service, you should use this: http://www.splunk.com/base/Documentation/latest/Admin/BindSplunktoanIP
For controlling the path taken by the forwarding service, I believe Splunk will just use the OS level networking, so you would implement that with a static route (e.g., the linux route command).
Does that answer your question?
I'm going to have to try it out, I'll let you know! 🙂