Currently my DMC, License Master, and Cluster Master are on different servers. Is there a risk in consolidating these components to a single server?

[paimonsoror]

All;

When our Splunk environment was set up by a consultant, he had used 3 different servers to host the DMC (Distributed Management Console), LM (License Master), and the CM (Cluster Master). I am trying to consolidate our environment and be a 'good-neighbor' by releasing servers back to our pool that are unnecessary. After taking a look at a few implementations at other places, it seems that typically the DMC, LM, and CM are hosted on a single server. It seems to make sense as these three components each do not require very much compute power.

I was wondering what the risk involved is in performing this consolidation? My current Cluster Master is a VM while the DMC and LM are cloud boxes, so ideally i would be moving everything to the CM server. I am not seeing much of a risk, and minus updating the cluster's license master server (we use an 'app' deployed to indexers and forwarders to configure the LM), this should be "easy". Am I missing something obvious?

[acharlieh]

Obligatory (slightly off topic but still hilarious) Splunk Reaction: http://splunkreactions.tumblr.com/post/131026761715/so-i-need-a-master-node-a-deployer-and-a

[bmacias84 · Accepted solution]

You can combine roles. I've combine the following rollows

Server: DMC, SHC Deployer, LM, Deployment Server

Server: CM, DMC, LM

I would never combine SHC Deployer and CM on a single server.

[paimonsoror]

Perfect, thanks to you both for the advice!

[aaraneta_splunk]

Hi @paimonsoror - Did one of the comments above help answer your question? If yes, please let me know that way I can convert the comment to an answer that can be accepted 🙂 Thanks!

[paimonsoror]

Hi @aaraneta , I would have to say that @bmacias84 answered the core question i had 🙂 Thanks!

[pradeepkumarg]

See if this helps

From - http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Systemrequirements

Machine requirements
Each node of the cluster (master node, peer nodes, and search heads) must run on its own, separate machine or virtual machine. Other than that, the hardware requirements, aside from storage, are basically the same as for any Splunk Enterprise instance. See "Reference hardware" in the Capacity Planning Manual.

The main difference is in the storage requirements for peer nodes, discussed below.

Note: The storage needs of the master node are significantly lower than those specified in the "Reference hardware" topic, since the master does not index external data.

[paimonsoror]

That makes sense, for sure. I guess the other question would be, does it make sense to have these 3 on a single piece of hardware? Like you said, our cluster master isn't doing any indexing of external data, and the license master and DMC are very quiet servers