Deployment Architecture

How many DMCs are needed in Active-Active Multisite architecture ?

sagaraverma
Loves-to-Learn Everything

We are planning to build an ACTIVE-ACTIVE multisite Splunk deployment, wherein each data center will have its own cluster master along with a set of search peers and search heads.

We are confused about whether we should go with two distributed management consoles, one at each site OR if only one DMC is enough for both the sites?

Please suggest !!

0 Karma

woodcock
Esteemed Legend

I would do a single global MC. If you are in a failure scenario, it is trivial to spin up a new MC from scratch, even by hand.

0 Karma

darrenfuller
Contributor

That would depend...

If you are setting up the multi-site environment because you are wanting DR or for the purpose of ensuring redundancy then you would likely want to have the monitoring setup with redundancy as well. That way if you lose a site, your monitoring will continue unfettered.

If you are setting up the multi-site environment to deal with network latency between sites or to enable search / forwarder affinity and are not worried about DR, then a single MC will likely be sufficient.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...