Splunk Search

Issues configuring search peer

Stokers_23
Explorer

I have recently configured a new Splunk Enterprise environment and I need to configure a search peer on my head instance. As i'm using puppet to configure all my instances, i'm doing this by adding the following to /opt/splunk/etc/system/local/distsearch.conf on the search head.

[distributedSearch]
servers=https://XXX.XX.XX.XX:8089

I'm also copying the trusted .pem file from the search head to the right folder on the peer. as per the documentation. I'm using our own IPA certificate to encrypt traffic between the instances. However after I restart Splunkd on both I get the following errors in the splunkd.log on the search head:

WARN DistributedPeer - Peer:https://XXX.XX.XX.XXX:8089 Unable to get server info from https://XXX.XX.XX.XXX:8089/services/server/info due to: Connect Timeout; exceeded 10000 milliseconds
WARN DistributedPeerManager - Cannot determine a latest common bundle, search may be blocked
WARN GetRemoteAuthToken - Unable to get auth token from peer: https://XXX.XX.XX.XXX:8089 due to: Connect Timeout; exceeded 5000 milliseconds

Sounds like a routing issue, however I can do an openssl s_client -connect from the search head to the peer on port 8089 and I can connect with no issues.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

If you are following steps given here https://docs.splunk.com/Documentation/Splunk/7.2.6/DistSearch/Configuredistributedsearch#Edit_distse... then those trusted.pem and private.pem are public and private key files not Certificate.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...