Installation

Three new indexers not showing up on Cluster Master as Instances but they do show up as Peers

Gregski11
Contributor

added three new Windows Indexers to my already three node index cluster and the new ones show up on the Peers page but not on the Instances page on the Cluster Master, I am new to Splunk so what did I do wrong

on cluster Master go to Settings \ DISTRIBUTED ENVIRONMENT \ Indexer Clustering - and here I can see all six indexers

however when I go to Settings  \ Monitor Console \ I only see the old three

 

Labels (1)
0 Karma
1 Solution

Gregski11
Contributor

we found the answer

 

Go to Settings > Monitoring Console > Settings > General Setup > "Apply Changes"

For some reason this fixed my issue as well despite making no other changes.

 

https://community.splunk.com/t5/Getting-Data-In/How-to-remove-an-indexer-from-the-distributed-manage...

 

 

View solution in original post

0 Karma

Gregski11
Contributor

we found the answer

 

Go to Settings > Monitoring Console > Settings > General Setup > "Apply Changes"

For some reason this fixed my issue as well despite making no other changes.

 

https://community.splunk.com/t5/Getting-Data-In/How-to-remove-an-indexer-from-the-distributed-manage...

 

 

0 Karma

codebuilder
Influencer

It's generally better practice to run the DMC on a standalone node but some do run it on the master as you're doing. When running the DMC on the master you need to understand there is a difference between what the master itself sees as the "leader" of the indexer cluster, and what the DMC is configured to monitor. They are two different things.

In any case, for monitoring the new nodes via DMC functionality you'll need to add them manually. See the documentation link below for the steps.

https://docs.splunk.com/Documentation/Splunk/8.2.1/DMC/Addinstancesassearchpeers

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

Gregski11
Contributor

thank you mate for that link, however the instructions specifically state Do not add cluster indexers, so I am still at a loss.

 

To add Splunk Enterprise instances as search peers to the monitoring console:

  1. Log into the instance on which you want to configure the monitoring console.
  2. In Splunk Web, click Settings > Distributed search > Search peers.
  3. Click New.
  4. Fill in the requested fields, and click Save.
  5. Repeat steps 3 and 4 for each search head, deployment server, license master, non-clustered indexer, and clustered search head. Do not add clustered indexers. If you are monitoring an indexer cluster and you are hosting the monitoring console on an instance other than the cluster master, you must add the cluster master as a search peer and you must configure the monitoring console instance as a search-head in that cluster.
0 Karma

codebuilder
Influencer

I'm not quite sure why the documentation reads that way, but if you want the indexers monitored by the DMC those are the steps to add them.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

Gregski11
Contributor

OK this is beyond bizarre, I go to add them like you said and it says 

Encountered the following error while trying to save: Peer with server name MyServer06 (not actual name) already exists.

So I look in the list of "peers" and sure enough the three new Indexers are there already without me adding them manually, however they still do not show up on the Overview page of the Monitoring Console, that's what is driving me crazy, how do I get them to show up there?  It's the page that shows you License Server, your Search Heads, your Cluster Master, your Development Servers, etc.

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...