How many DMCs are needed in Active-Active Multisite architecture ?

[sagaraverma]

We are planning to build an ACTIVE-ACTIVE multisite Splunk deployment, wherein each data center will have its own cluster master along with a set of search peers and search heads.

We are confused about whether we should go with two distributed management consoles, one at each site OR if only one DMC is enough for both the sites?

Please suggest !!

[woodcock]

I would do a single global MC. If you are in a failure scenario, it is trivial to spin up a new MC from scratch, even by hand.

[darrenfuller]

That would depend...

If you are setting up the multi-site environment because you are wanting DR or for the purpose of ensuring redundancy then you would likely want to have the monitoring setup with redundancy as well. That way if you lose a site, your monitoring will continue unfettered.

If you are setting up the multi-site environment to deal with network latency between sites or to enable search / forwarder affinity and are not worried about DR, then a single MC will likely be sufficient.