Getting Data In

BIND IP Causing issues with RTSearch...

balbano
Contributor

We have done an interface binding (to IP: index1_IP) on one of our indexers.

This was done on one of the indexer (indexer1) as testing:

etc/splunk-launch.conf:

SPLUNK_BINDIP=index1_IP

etc/system/local/web.conf:

mgmtHostPort = index1_IP:8089

Afterward, we noticed an issue with the live-tail feature on both the search head and indexer:

search head:

[index1] Streamed search execute failed because: Error in 'RealTimeSearch': Failed to connect with url 'https://127.0.0.1:8089/services/streams/rtsearch' because of Encountered a connection error for host 127.0.0.1:8089\n..

from index1:

Failed to create result provider for remote peer 'index1' at uri '' with the stream 'rtlitsearch ( host=arg1* OR host=arg2* ) arg3 | fields keepcolorder=t * "*" "host" "index" "source" "sourcetype" "splunk_server"'.

It seems from the error displayed on the search head that it's not tailing the indexer by the correct IP.

Are we missing more parameter in some conf files in order to bind to the IP successfully?

Let me know if you guys need any further info.

Just FYI that we have an open support case for this but we have not heard back from Splunk Support so I am trying Splunk Answers since you guys are always fast and helpful.

Thanks.

Brian

0 Karma
1 Solution

balbano
Contributor

As a workaround until someone can shed some light on this, we have done the following:

  • Installed rinetd in order to do port forwarding from 127.0.0.1:8089--->index1_IP:8089...

This seems to have fixed the problem until we hear from anyone here or from the support engineers.

Brian

View solution in original post

0 Karma

matt
Splunk Employee
Splunk Employee

The two functions (BINDIP and Real-time search) do not play well with each other. This is being tracked as SPL-32549 and we hope to have it addressed in an upcoming maintenance release

0 Karma

balbano
Contributor

As a workaround until someone can shed some light on this, we have done the following:

  • Installed rinetd in order to do port forwarding from 127.0.0.1:8089--->index1_IP:8089...

This seems to have fixed the problem until we hear from anyone here or from the support engineers.

Brian

0 Karma

Paolo_Prigione
Builder

Hi, have you tried this stanza configuration in the etc/system/local/server.conf file?

[httpServerListener:index1_IP:8089]
ssl = true
0 Karma

balbano
Contributor

This did not resolve the issue.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...