Deployment Architecture

Currently my DMC, License Master, and Cluster Master are on different servers. Is there a risk in consolidating these components to a single server?

paimonsoror
Builder

All;

When our Splunk environment was set up by a consultant, he had used 3 different servers to host the DMC (Distributed Management Console), LM (License Master), and the CM (Cluster Master). I am trying to consolidate our environment and be a 'good-neighbor' by releasing servers back to our pool that are unnecessary. After taking a look at a few implementations at other places, it seems that typically the DMC, LM, and CM are hosted on a single server. It seems to make sense as these three components each do not require very much compute power.

I was wondering what the risk involved is in performing this consolidation? My current Cluster Master is a VM while the DMC and LM are cloud boxes, so ideally i would be moving everything to the CM server. I am not seeing much of a risk, and minus updating the cluster's license master server (we use an 'app' deployed to indexers and forwarders to configure the LM), this should be "easy". Am I missing something obvious?

0 Karma
1 Solution

bmacias84
Champion

You can combine roles. I've combine the following rollows

Server: DMC, SHC Deployer, LM, Deployment Server

Server: CM, DMC, LM

I would never combine SHC Deployer and CM on a single server.

View solution in original post

acharlieh
Influencer

Obligatory (slightly off topic but still hilarious) Splunk Reaction: http://splunkreactions.tumblr.com/post/131026761715/so-i-need-a-master-node-a-deployer-and-a

bmacias84
Champion

You can combine roles. I've combine the following rollows

Server: DMC, SHC Deployer, LM, Deployment Server

Server: CM, DMC, LM

I would never combine SHC Deployer and CM on a single server.

paimonsoror
Builder

Perfect, thanks to you both for the advice!

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

Hi @paimonsoror - Did one of the comments above help answer your question? If yes, please let me know that way I can convert the comment to an answer that can be accepted 🙂 Thanks!

0 Karma

paimonsoror
Builder

Hi @aaraneta , I would have to say that @bmacias84 answered the core question i had 🙂 Thanks!

pradeepkumarg
Influencer

See if this helps

From - http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Systemrequirements

Machine requirements
Each node of the cluster (master node, peer nodes, and search heads) must run on its own, separate machine or virtual machine. Other than that, the hardware requirements, aside from storage, are basically the same as for any Splunk Enterprise instance. See "Reference hardware" in the Capacity Planning Manual.

The main difference is in the storage requirements for peer nodes, discussed below.

Note: The storage needs of the master node are significantly lower than those specified in the "Reference hardware" topic, since the master does not index external data.

0 Karma

paimonsoror
Builder

That makes sense, for sure. I guess the other question would be, does it make sense to have these 3 on a single piece of hardware? Like you said, our cluster master isn't doing any indexing of external data, and the license master and DMC are very quiet servers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...