Monitoring Console(MC) and Clustered Indexers. MC is only seeing indexers on one site meanwhile cluster includes two sites

[santorof]

Have a server that performs my indexer clustering where my 20 indexers(10 per site) check in. On my monitoring console I wanted to check on each machines health but I only see 10 of my indexers from site 1 and not my other 10 indexers from site 2. The cluster master machine is on the same subnet as site 1 whereas site 2 is on another subnet. I dont see this as a potential issue though because my site 2 indexers are able to communicate with the master and replicate without issue(meeting all factors).

Are there any settings I need to change on my cluster master or my site 2 indexers?

[koshyk · Accepted solution]

You have to change this setting in the server which hosts your DMC (MC).

You can either do it via the server which contains the Monitoring Console UI

Main Splunk -> Settings -> Distributed search » Search peers   and add/authenticate your indexers which are missing
Then in the MC,  Settings -> Distributed -> Apply Changes  (Ensure all the indexers are in the list below and roles are correct)

or via distsearch.conf entry like below

[distributedSearch:dmc_group_indexer]
servers =    https://indexer-slave-01:8089 , https://indexer-slave-02:8089 , https://indexer-slave-03:8089 , https://indexer-slave-04:8089

[distributedSearch:dmc_indexerclustergroup_my_idx_cluster1]
servers = localhost:localhost,   https://indexer-slave-01:8089 , https://indexer-slave-02:8089 , https://indexer-slave-03:8089 , https://indexer-slave-04:8089

[amithtelkar01]

Buy You a Beer ! Thanks

[santorof]

Looking into Distributed search I thought that the other indexers were added since my cluster server is considered a search head but thats not the case. I have added my other indexers to DS and everything looks great. Thanks!