Deployment Architecture

register_search_address and master -> slave communication

sbaryakov
Explorer

Should register_search_address also be the address on which the master connects back to slaves?

according to documentation:

register_search_address = IP address, or fully qualified machine/domain name

* Only valid for mode=slave
* This is the address on which a slave will be available as search head.
  This is useful in the cases where a splunk host machine has multiple 
  interfaces and only one of them can be reached by another splunkd instance.

However when I test it I see that the master is trying to connect back to slaves on actual source IP of the connection from the slave. If register_search_address is not the right config variable for master -> slave communication address, then which one is it?

Thank you!

Tags (3)

weeb
Splunk Employee
Splunk Employee

Unfortunately, register_search_address does not work as expected, and the following bug has been filed for attention: SPL-83902.

weeb
Splunk Employee
Splunk Employee

This has been fixed and will be available in 6.2.4.

Please contact Support for a patch if you need a fix prior to the release of 6.2.4.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...