How to configure Management Tier on 2 sites

[SatriaCiso]

Hi,

I have the situation that the need for Installation management tier on 2 sites (DC and DR) on VPC server. the problem is, I don't have the permission to capture the Vmotion from 1 site to another. Why I need to install the management tier to both sites because, I want to upgrade the OS currently RHEL 7.9 (EOS soon) to RHEL 8.9, and the compan

And, If I just Installed both sites, how to sync the data from 1 management tier to another, do I need to copy the data every day or just once.

need help, Would Be Appreciated

[gcusello]

Hi @SatriaCiso,

Splunk Indexer Clusters (Single or Multi Site) have always one Cluster Manager and the Cluster runs also when the CM is down, so you don't need a second CM in your architecture.

If you want to have a second CM, it must have the same hostname and IP of the first and must be usually down, and turned on only when the first one is down.

You can read this at https://docs.splunk.com/Documentation/Splunk/9.1.2/Indexer/Multisiteclusters and at https://www.splunk.com/en_us/pdfs/tech-brief/splunk-validated-architectures.pdf

Ciao.

Giuseppe

[SatriaCiso]

Hi,

Thank you, sir, but I mean the management tier was: Deployer server, Deployment server, License master and Cluster master, those servers need to be on both sites. Because our policy that the Management tier must have a disaster recovery site.

And if i have second Management tier, its must have the different hostname and IPs 

Thank you,

Satriaciso

[gcusello · Accepted solution]

Hi @SatriaCiso.

As I said for the Cluster Manager, is the same thing for all Management servers: in Splunk architecture you cannot have two of them.

And anyway, the cluster continues to run also without these components.

Eventually you can have a turned off copy but with the same hostname and IP address, because you cannot configure two Cluster managers or two Deployers and so on: they must be only one of them.

This is fully described in the above links.

Ciao.

Giuseppe