Installation

Monitoring Console & SH deployer for multisite cluster

Somesh
Explorer

I have seen the splunk documentation for setting up Splunk Multisite Cluster but I have not seen anything related to Monitoring Console & SH Deployer. Can some one suggest on how to setup these two ?

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Somesh ,

could you better describe your requirement?

SHC-Deployer is a management system that must be configured for a Search Head Cluster in one of the two sites.

It doesn't require a secondary copy in the secondary site because the Search Head Cluster continues to work also without the Deployer, the only limitation is that you cannot deploy a new app until the Deployer will be again available.

At the same time, you can have one Monitoring Console, you have to configure using the documentation at https://docs.splunk.com/Documentation/Splunk/9.3.1/DMC/DMCoverview

You could also create a secondary server in the secondary site, but it isn't required for the activity.

Ciao.

Giuseppe

0 Karma

Somesh
Explorer

Previously i had setup Single cluster with below requirements.

Indexer Cluster with 3 machines.

Search head with 3 machines.

manager, Monitoring Console & Sh Deployer with 1 machine.

Now I need to setup a multisite cluster with below requirements.

Site1

Indexers: 3

Search head: 2

Manager: 1

Site 2 

Indexers: 3

Search head: 2

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Somesh ,

I don't like that the Cluster Manager and the SHC-Deployer is on the same server, I'd prefer a dedicated Cluster Manager, but what's the issue?

Both Indexers and Search Head Cluster continue to work also without Cluster Manager and Deployer so your infrastructure continue to work also in case od unavailability of Site1.

The real question should be: can my infrastructure manage the log volume and the searches?

If yes, you don't have issues.

Ciao.

Giuseppe

0 Karma

Somesh
Explorer

Okay my question was In case if we want to setup deployer for multisite cluster should we follow the same procedure like we did on the Single Cluster

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Somesh ,

yes, it's the same.

Only one attention point: configure on your Search Heads the search affinity.

This is relevant to have more performant searcheas and avoid that a Searc Head uses the other site Indexers, but mainly because otherwise a Search Head, when the primary site is down, continue to search also on the Site1 Indexers so it doesn't find a part of data.

I encountered this issue during an acceptance test!

Ciao.

Giuseppe

0 Karma

Somesh
Explorer

Sorry! My bad!!  Manager & the SHC-Deployer each 1 machine.

 

So you suggest SHC-Deployer is not required for Mulitsite Cluster ?

 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...