Monitoring Console & SH deployer for multisite cluster

[Somesh]

I have seen the splunk documentation for setting up Splunk Multisite Cluster but I have not seen anything related to Monitoring Console & SH Deployer. Can some one suggest on how to setup these two ?

[gcusello]

Hi @Somesh ,

could you better describe your requirement?

SHC-Deployer is a management system that must be configured for a Search Head Cluster in one of the two sites.

It doesn't require a secondary copy in the secondary site because the Search Head Cluster continues to work also without the Deployer, the only limitation is that you cannot deploy a new app until the Deployer will be again available.

At the same time, you can have one Monitoring Console, you have to configure using the documentation at https://docs.splunk.com/Documentation/Splunk/9.3.1/DMC/DMCoverview

You could also create a secondary server in the secondary site, but it isn't required for the activity.

Ciao.

Giuseppe

[Somesh]

Previously i had setup Single cluster with below requirements.

Indexer Cluster with 3 machines.

Search head with 3 machines.

manager, Monitoring Console & Sh Deployer with 1 machine.

Now I need to setup a multisite cluster with below requirements.

Site1

Indexers: 3

Search head: 2

Manager: 1

Site 2 

Indexers: 3

Search head: 2

[gcusello]

Hi @Somesh ,

I don't like that the Cluster Manager and the SHC-Deployer is on the same server, I'd prefer a dedicated Cluster Manager, but what's the issue?

Both Indexers and Search Head Cluster continue to work also without Cluster Manager and Deployer so your infrastructure continue to work also in case od unavailability of Site1.

The real question should be: can my infrastructure manage the log volume and the searches?

If yes, you don't have issues.

Ciao.

Giuseppe

[Somesh]

Okay my question was In case if we want to setup deployer for multisite cluster should we follow the same procedure like we did on the Single Cluster

[gcusello]

Hi @Somesh ,

yes, it's the same.

Only one attention point: configure on your Search Heads the search affinity.

This is relevant to have more performant searcheas and avoid that a Searc Head uses the other site Indexers, but mainly because otherwise a Search Head, when the primary site is down, continue to search also on the Site1 Indexers so it doesn't find a part of data.

I encountered this issue during an acceptance test!

Ciao.

Giuseppe

[Somesh]

Sorry! My bad!!  Manager & the SHC-Deployer each 1 machine.

So you suggest SHC-Deployer is not required for Mulitsite Cluster ?