topic Re: Difference between Splunk monitoring console and Distributed management console in Reporting

Difference between Splunk monitoring console and Distributed management console

SamHTexas — Thu, 18 Mar 2021 17:38:23 GMT

What is the Difference between Splunk monitoring console and Distributed management console. How doo I access Dist. monitoring console ?

Re: Difference between Splunk monitoring console and Distributed management console

scelikok — Thu, 18 Mar 2021 20:18:49 GMT

Hi @SamHTexas,

The difference is Distributed Monitoring Console monitors your distributed deployment. You should enable Distributed mode inside the monitoring console. Please see below documentation;

https://docs.splunk.com/Documentation/Splunk/8.1.2/DMC/Configureindistributedmode

Re: Difference between Splunk monitoring console and Distributed management console

richgalloway — Fri, 19 Mar 2021 12:05:00 GMT

Monitoring Console is the new name for the Distributed Management Console. They are the same thing.

Re: Difference between Splunk monitoring console and Distributed management console

SamHTexas — Fri, 19 Mar 2021 16:26:39 GMT

Hello, Rich should I enable distributed mode in my Monitoring console as suggested by another great helper?

Re: Difference between Splunk monitoring console and Distributed management console

richgalloway — Fri, 19 Mar 2021 21:27:21 GMT

If you have a distributed Splunk environment then, yes, the MC absolutely should be in Distributed mode. Only configure one MC, however. Put it on your License Manager or another lightly-used instance.

Re: Difference between Splunk monitoring console and Distributed management console

SamHTexas — Fri, 19 Mar 2021 21:47:14 GMT

One more question please. I am going to change to dist. mode. But the deployment I have walked into. They hav a monitoring console on almost every Splunk server like om MC, LM, SHs etc. Should I remove most & only keep one Monitoring console in Dist. mode? Thax again

Re: Difference between Splunk monitoring console and Distributed management console

richgalloway — Sat, 20 Mar 2021 12:09:15 GMT

The MC is built-in to every Splunk instance (except UF). Only one of them should be in Distributed mode; the rest should be in Standalone mode. The instance you choose to be the MC should have visibility into all other instances (make them search peers).

Re: Difference between Splunk monitoring console and Distributed management console

SamHTexas — Sat, 20 Mar 2021 19:12:08 GMT

Please show me how to make the MCs peers with the MC in distributed mode. I appreciate your time.

Re: Difference between Splunk monitoring console and Distributed management console

richgalloway — Sun, 21 Mar 2021 17:59:00 GMT

The MC does not peer with other MCs. It peers with other Splunk instances. Do so the same way you would peer a search head with an indexer. Go to Settings->Distributed Search and add all of the non-forwarder Splunk servers as peers to the MC. Then open the MC and select Settings->General Setup, review the server list, and click Apply Changes.

See https://docs.splunk.com/Documentation/Splunk/8.1.2/DMC/Configureindistributedmode for details.

Re: Difference between Splunk monitoring console and Distributed management console

SamHTexas — Mon, 22 Mar 2021 14:38:29 GMT

One more question please reg Distributed mode in the MC. In the Splunk environment I have inherited. There are 2 Monitoring consoles both in Distributed mode, does this cause problems?

Re: Difference between Splunk monitoring console and Distributed management console

richgalloway — Mon, 22 Mar 2021 15:59:03 GMT

Having 2 MCs will create excess load in your Splunk environment, but should not cause real problems. Best to disable one of them, however, so you have a single source of truth and only one MC to keep current.