Splunk Search

Distributed Search times out when trying to add a peer

yazapage
Explorer

I get the following error after I add a search peer - times out. The port is open in our firewall & sending to an internal search head.

ERROR KeyManagerLocalhost - Error while sending public key to search peer https://172.18.4
8.146:4351: Connect timed out.

Is there something other than port 4351 I need to set up somewhere? I can add a search peer within the firewall wtih no issues.

Tags (2)
0 Karma

yazapage
Explorer

Thanks - I believe we only have inbound traffic allowed. I will check with my firwall team to confirm

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I don't know what you mean when you say "sending to an internal search head", but that port is the port on the search peer/indexer, and as such, the firewall must allow TCP connections outbound from the search head to that port on the indexer. A timeout suggests that the firewall in fact is not allowing the required traffic.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...