Deployment Architecture

How to set up search head in Distributed Management Console of master node ?

sunrise
Contributor

Hi Splunkers,

Distributed Management Console(DMC) is the new feature of Splunk V6.2.
http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/ConfiguretheMonitoringConsole

I configured the splunk clustering system - 1 search head, 3 peers, 1 master node - .
And I configured outputs.conf in search head as follows.

[indexAndForward]
index = false

[tcpout]
defaultGroup = my_search_peers
forwardedindex.filter.disable = true
indexAndForward = false

[tcpout:my_search_peers]
server=peer1.cluster.splunk.com:9997,peer2.cluster.splunk.com:9997,peer3.cluster.splunk.com:9997
useACK = true

And after setting peers as receivers, I confirmed peers received the search head internal log.
I selected the master node as DMC, but the search head is not appeared in "Setup".
How to list search head node in DMC of the master node ?

Thank you for your help.

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

As documented in the page you linked to - specifically http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/ConfiguretheMonitoringConsole#Add_instances_... - you need to add the search heads as search peers to the master node.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

As documented in the page you linked to - specifically http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/ConfiguretheMonitoringConsole#Add_instances_... - you need to add the search heads as search peers to the master node.

sunrise
Contributor

Thank you martin_mueller as always. I've compeletely overlooked.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...