Archive
Highlighted

Clustered Indexers not shown within the DMC despite adding the Master Node as search peer in DMC

Builder

As per the documentation for adding search peers in DMC which states Do not add clustered indexers, but be sure to add clustered search heads. If you are monitoring an indexer cluster and you are hosting the monitoring console on an instance other than the cluster master, you must add the cluster master(CM) as a search peer.
I have added C.M as a search peer and haven't added any clustered indexers as search peer. However, still I am unable to see Indexers on the overview page of the DMC or under General settings page. All it shows that the Master Node has two peers.

Is this an expected behaviour ?

Tags (1)
0 Karma
Highlighted

Re: Clustered Indexers not shown within the DMC despite adding the Master Node as search peer in DMC

SplunkTrust
SplunkTrust

Hi @damode,

Is your MC pointed to Cluster Master to search data from Indexer Cluster Like this https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Enablethesearchhead#Enable_the_search_hea... ?

Docs didn't provide this information and it assumes that if you are running Indexer Cluster and configuring MC on other than Cluster Master then your MC server already configured as Search Head and pointed to Cluster Master to search the data from Indexer Cluster.

View solution in original post

0 Karma
Highlighted

Re: Clustered Indexers not shown within the DMC despite adding the Master Node as search peer in DMC

Builder

if I have a search head cluster then should I enable the search head on all 3 search heads ?

0 Karma
Highlighted

Re: Clustered Indexers not shown within the DMC despite adding the Master Node as search peer in DMC

SplunkTrust
SplunkTrust

On which node you are configuring MC ? You can't setup MC on Search Head Cluster members.

0 Karma
Highlighted

Re: Clustered Indexers not shown within the DMC despite adding the Master Node as search peer in DMC

Builder

oh sorry I am mistaken. did you mean enabling search head on the MC ?

0 Karma
Highlighted

Re: Clustered Indexers not shown within the DMC despite adding the Master Node as search peer in DMC

SplunkTrust
SplunkTrust

Yes, MC is kind of search head only but The instance hosting the monitoring console must not run any searches unrelated to its function as monitoring console. The exception to this rule is if you are using the console to monitor a standalone single-instance deployment.

0 Karma
Highlighted

Re: Clustered Indexers not shown within the DMC despite adding the Master Node as search peer in DMC

Builder

Got it. I am already running a dedicated MC separate to a SHC I have deployed.

0 Karma
Highlighted

Re: Clustered Indexers not shown within the DMC despite adding the Master Node as search peer in DMC

Influencer

I'm not sure how could you have that information without having the indexers as search peers of the MC to be honest

0 Karma
Highlighted

Re: Clustered Indexers not shown within the DMC despite adding the Master Node as search peer in DMC

Builder

Yes, that was my view too but the docs clearly say not to add any clustered indexers. What they failed to mention was that the DMC has to be added as a search head within the indexer clustering setting.

0 Karma
Highlighted

Re: Clustered Indexers not shown within the DMC despite adding the Master Node as search peer in DMC

Influencer

If your Monitoring Console is not a SearchHead of the Indexer Cluster, you'll need to add the indexers to the MC as search peers anyway. If MC is a search head of the Indexer Cluster, it will automatically be searching the indexers and you don't need to add them

0 Karma