All Apps and Add-ons

managing multiple standalone splunk instances

bkumarm
Contributor

I have about five standalone hosts that run Splunk Enterprise instances ( independent). They are used by different users for their own purposes. I don't want to setup a cluster.
I want to do the following:
1. Monitor the index usage on these hosts.
2. Monitor disk usage and alert based on preset limit
3. set periodic alert - example: after 3 months

is there any way to achieve this in a centralized host and generate usage reports?

thanks,
Bharath

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

Building on what @adonio says, you can setup the MC (Management Console) on of the hosts. You then need to add all of the other members as search peers on the host with the MC. You can then go into the MC and configure the roles for each member, and monitor it via the prebuilt panels and alerts.

View solution in original post

sbbadri
Motivator
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Building on what @adonio says, you can setup the MC (Management Console) on of the hosts. You then need to add all of the other members as search peers on the host with the MC. You can then go into the MC and configure the roles for each member, and monitor it via the prebuilt panels and alerts.

bkumarm
Contributor

tried it ..MC webUI does not have any option to add members. should I use CLI? or any specific configuration?

0 Karma

bkumarm
Contributor

I referred the MC documentation ad added search peers on one of the boxes. This is really awesome feature that provides useful reports on critical data.

0 Karma

adonio
Ultra Champion

use one of them to look at all the other 4 and search the _internal data
look at distributed search

0 Karma

bkumarm
Contributor

did you mean I have to forward internal logs into one host? it may become a breakdown point.. because if I loose the host, the monitoring data would be gone ..correct?

0 Karma

adonio
Ultra Champion

you dont have to forward logs
pick 1 instance, navigate to settings (top right corner) -> click "Distributed search" -> click "Search Peers" -> click "add new" -> add all 4 splunk instances as peers.
you are all set

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...