https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309658#M11749 <P>Hi @aaraneta , I would have to say that @bmacias84 answered the core question i had <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Thanks!</P> Fri, 17 Feb 2017 21:19:50 GMT paimonsoror 2017-02-17T21:19:50Z https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309651#M11742 <P>All;</P> <P>When our Splunk environment was set up by a consultant, he had used 3 different servers to host the DMC (Distributed Management Console), LM (License Master), and the CM (Cluster Master). I am trying to consolidate our environment and be a 'good-neighbor' by releasing servers back to our pool that are unnecessary. After taking a look at a few implementations at other places, it seems that typically the DMC, LM, and CM are hosted on a single server. It seems to make sense as these three components each do not require very much compute power.</P> <P>I was wondering what the risk involved is in performing this consolidation? My current Cluster Master is a VM while the DMC and LM are cloud boxes, so ideally i would be moving everything to the CM server. I am not seeing much of a risk, and minus updating the cluster's license master server (we use an 'app' deployed to indexers and forwarders to configure the LM), this should be "easy". Am I missing something obvious?</P> Fri, 17 Feb 2017 14:34:12 GMT https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309651#M11742 paimonsoror 2017-02-17T14:34:12Z https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309652#M11743 <P>See if this helps</P> <P>From - <A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Systemrequirements">http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Systemrequirements</A></P> <P>Machine requirements<BR /> <B>Each node of the cluster (master node, peer nodes, and search heads) must run on its own, separate machine or virtual machine.</B> Other than that, the hardware requirements, aside from storage, are basically the same as for any Splunk Enterprise instance. See "Reference hardware" in the Capacity Planning Manual.</P> <P>The main difference is in the storage requirements for peer nodes, discussed below.</P> <P>Note: The storage needs of the master node are significantly lower than those specified in the "Reference hardware" topic, since the master does not index external data.</P> Fri, 17 Feb 2017 16:21:26 GMT https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309652#M11743 pradeepkumarg 2017-02-17T16:21:26Z https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309653#M11744 <P>That makes sense, for sure. I guess the other question would be, does it make sense to have these 3 on a single piece of hardware? Like you said, our cluster master isn't doing any indexing of external data, and the license master and DMC are very quiet servers</P> Fri, 17 Feb 2017 17:48:07 GMT https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309653#M11744 paimonsoror 2017-02-17T17:48:07Z https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309654#M11745 <P>You can combine roles. I've combine the following rollows</P> <P>Server: DMC, SHC Deployer, LM, Deployment Server </P> <P>Server: CM, DMC, LM</P> <P>I would never combine SHC Deployer and CM on a single server.</P> Fri, 17 Feb 2017 18:29:56 GMT https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309654#M11745 bmacias84 2017-02-17T18:29:56Z https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309655#M11746 <P>Perfect, thanks to you both for the advice!</P> Fri, 17 Feb 2017 18:32:41 GMT https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309655#M11746 paimonsoror 2017-02-17T18:32:41Z https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309656#M11747 <P>Hi @paimonsoror - Did one of the comments above help answer your question? If yes, please let me know that way I can convert the comment to an answer that can be accepted <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Thanks!</P> Fri, 17 Feb 2017 20:27:52 GMT https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309656#M11747 aaraneta_splunk 2017-02-17T20:27:52Z https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309657#M11748 <P>Obligatory (slightly off topic but still hilarious) Splunk Reaction: <A href="http://splunkreactions.tumblr.com/post/131026761715/so-i-need-a-master-node-a-deployer-and-a">http://splunkreactions.tumblr.com/post/131026761715/so-i-need-a-master-node-a-deployer-and-a</A></P> Fri, 17 Feb 2017 20:34:18 GMT https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309657#M11748 acharlieh 2017-02-17T20:34:18Z https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309658#M11749 <P>Hi @aaraneta , I would have to say that @bmacias84 answered the core question i had <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Thanks!</P> Fri, 17 Feb 2017 21:19:50 GMT https://community.splunk.com/t5/Deployment-Architecture/Currently-my-DMC-License-Master-and-Cluster-Master-are-on/m-p/309658#M11749 paimonsoror 2017-02-17T21:19:50Z