Have a server that performs my indexer clustering where my 20 indexers(10 per site) check in. On my monitoring console I wanted to check on each machines health but I only see 10 of my indexers from site 1 and not my other 10 indexers from site 2. The cluster master machine is on the same subnet as site 1 whereas site 2 is on another subnet. I dont see this as a potential issue though because my site 2 indexers are able to communicate with the master and replicate without issue(meeting all factors).
Are there any settings I need to change on my cluster master or my site 2 indexers?
You have to change this setting in the server which hosts your DMC (MC).
You can either do it via the server which contains the Monitoring Console UI
Main Splunk -> Settings -> Distributed search » Search peers and add/authenticate your indexers which are missing Then in the MC, Settings -> Distributed -> Apply Changes (Ensure all the indexers are in the list below and roles are correct)
or via distsearch.conf entry like below
[distributedSearch:dmc_group_indexer] servers = https://indexer-slave-01:8089 , https://indexer-slave-02:8089 , https://indexer-slave-03:8089 , https://indexer-slave-04:8089 [distributedSearch:dmc_indexerclustergroup_my_idx_cluster1] servers = localhost:localhost, https://indexer-slave-01:8089 , https://indexer-slave-02:8089 , https://indexer-slave-03:8089 , https://indexer-slave-04:8089
Looking into Distributed search I thought that the other indexers were added since my cluster server is considered a search head but thats not the case. I have added my other indexers to DS and everything looks great. Thanks!