Is there something wrong with my server roles?

[hrithiktej]

We have 6 Splunk servers. 2 are indexers, 1 is license server, 1 deployment server, 1 ADHOC search head & 1 ES server.

When I check the server roles for each of them it shows each of them is an indexer, license master, search head etc.

Would this be affecting our splunk servers performance, Ideally there should be only one role for every server right? for example: Indexer should be only Indexer & License master only license master and search head only search head.

[jcrabb_splunk · Accepted solution]

If you are referencing what is listed in the DMC or Monitoring Console, that is configurable and has no actual impact on the environment. It simply takes that information and applies it the various components of the app. Each host may have wrong roles selected and you can make the appropriate changes to fix that. It may be worth the time to review the documentation on that app. I would start with following section of the monitoring console document and then walk through the how to validate via configuration files the topology of the environment that are on the very next page:

http://docs.splunk.com/Documentation/Splunk/6.6.2/InheritedDeployment/MCdiscovery#Validate_your_moni...

Here is the first page of the main doc for this app for reference:

https://docs.splunk.com/Documentation/Splunk/6.6.2/DMC/DMCoverview

If that is not the right version of Splunk, you can select the appropriate version in the top right corner. Also, if are on a version prior to 6.5, you will want to refer to the Distributed Management Console (DMC) document:

https://docs.splunk.com/Documentation/Splunk/6.4.0/DMC/DMCoverview

[hrithiktej]

Thank you this helps.