- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: If we enable DMC in search head in Production ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If we enable DMC in search head in Production environment is there any impact on the searches
If we enable DMC in Search head in a Production environment is there any impact on the searches.
I have a lot of historical searches are running on it.
Is it the Best practice to do?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just enabling it will not cause any problems BUT, if you fully configure it and add non-indexers as search peers (which you have to do to get the full features/data), you will be creating potential search results data duplication, search delays, incorrect warnings and errors reported in the UI and other minor problems. None of these are serious, but it is still a poor practice.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is there any way I can roll back to the standalone mode.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Because it has 84 search peers and 90 cluster master
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
click settingdg dropdown -> general settings -> on the top line (your DMC instance name) on the right hand side click edit -> disable. notice it says "disabled" with a little red X
Do not click "Apply All Changes" afterwards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
best will be to have a dedicated Search Head for the DMC (now MC)
read here:
https://docs.splunk.com/Documentation/Splunk/7.1.1/DMC/WheretohostDMC
and here more specific to your question:
https://docs.splunk.com/Documentation/Splunk/7.1.1/DMC/WheretohostDMC#Why_not_to_host_the_console_on...
hope it helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Q) I have enabled DMC in distributed mode is there a way I can come back to standalone mode.
Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...
Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...
Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...
