Deployment Architecture

Splunk 6.2 new Distributed Management Console - How to add nodes not automatically discovered?

guilmxm
SplunkTrust
SplunkTrust

Hello,

I am trying to setup the new 6.2 Distributed Management Console to cover all nodes of a testing cluster, but i can't figure out how to add nodes when they are not automatically discovered by Splunk.

I have a testing cluster with 3 peer nodes, 3 search heads in sh clustering mode and 1 deployment server:

  • splunk-master
  • splunk-peer1/2/3
  • splunk-head1/2/3
  • splunk-deployment

All non peers nodes (master, heads and deployment) are setup to forward data without locally indexing, according to Splunk good practices:

http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Forwardmasterdata

As you can see, every data of every nodes are available within the cluster data:

alt text

In the master node Distributed Management Console, i will always only see the master node and peer nodes available:

alt text

I have read the Distributed Management console:

http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/ConfiguretheMonitoringConsole

I understood the Distributed console cannot be set in a search head which part of an sh cluster, this is not the case here as the distributed console is configured in the master node (one of recommended scenarios)

I have tried manually adding missing nodes in the assets/lookup table "splunk_management_console/lookups/assets.csv" without much success, hosts becomes visible but are not accessible.

What i am missing ?

Thanks !

1 Solution

guilmxm
SplunkTrust
SplunkTrust

Nodes to be monitored from the Distributed Management Console must added as peers in the Distributed config interface:

Settings / Distributed search

Or they won't be available within the DMC

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Quote from your docs links: "Add each search head, deployment server, license master, and standalone indexer as a distributed search peer to the instance hosting the distributed management console."

guilmxm
SplunkTrust
SplunkTrust

Perfectly right 🙂

In front of me but it didn't saw it... or understood it !

Thanks again.

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Nodes to be monitored from the Distributed Management Console must added as peers in the Distributed config interface:

Settings / Distributed search

Or they won't be available within the DMC

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Are your search heads distributed search peers of the DMC instance?

guilmxm
SplunkTrust
SplunkTrust

All right !!!

With the help of your comment, i understood what i have missed, you need to configure the distributed search by adding each peers your want to monitor in the DMC 🙂 Going in "Settings/Distributed Search" and adding each node to be monitored.

I think maybe the doc should mention this explicitely.

Thanks you

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.