Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- How to enable monitoring console via command line
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have a problem with finding where in configuration files should I change to enable monitoring console in my distributed environment.
Long story short:
I have distributed environment: a few indexers, a few search heads, cluster node.
I would like to configure for them monitoring console. I can do it via WebUI but in my case I would like to know which configuration file from command line should I edit in order to do the same. Could you help please ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @xxmazurt,
On which node would you like to setup monitoring console? Because splunk recommend it to setup on standalone search head which is not used for general purpose or you can setup on CM as well if CM is not heavily loaded.
As far as I know Monitoring Console configuration will be in $SPLUNK_HOME/etc/system/local/distsearch.conf and $SPLUNK_HOME/etc/apps/splunk_management_console/local/splunk_management_console_assets.conf
EDIT: After changing name from Splunk DMC to Monitoring Console it looks like app name changed from splunk_management_console to splunk_monitoring_console so in that case please check $SPLUNK_HOME/etc/apps/splunk_monitoring_console/local/splunk_monitoring_console_assets.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
here you can find a steps which must be taken to setup distributed mode: https://community.splunk.com/t5/Monitoring-Splunk/Turn-on-Monitoring-Console-Distributed-Mode-via-CL...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @xxmazurt,
On which node would you like to setup monitoring console? Because splunk recommend it to setup on standalone search head which is not used for general purpose or you can setup on CM as well if CM is not heavily loaded.
As far as I know Monitoring Console configuration will be in $SPLUNK_HOME/etc/system/local/distsearch.conf and $SPLUNK_HOME/etc/apps/splunk_management_console/local/splunk_management_console_assets.conf
EDIT: After changing name from Splunk DMC to Monitoring Console it looks like app name changed from splunk_management_console to splunk_monitoring_console so in that case please check $SPLUNK_HOME/etc/apps/splunk_monitoring_console/local/splunk_monitoring_console_assets.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi harsmarvania57,
Thank you for the answer. I found what I've been looking for at $SPLUNK_HOME/etc/apps/splunk_monitoring_console
I have intention to put CM on master node.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I guess below two files as well,
/opt/splunk/etc/apps/splunk_monitoring_console/lookups/assets.csv
/opt/splunk/etc/apps/splunk_monitoring_console/lookups/dmc_forwarder_assets.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If my answer helped you then you can accept it and up vote my answer so that this question will be closed.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
