Monitoring Splunk

In which config file are DMC roles and DMC Distributed mode defined?

ncrisler
New Member

Currently working on automation a Splunk build and am wondering where DMC roles and DMC distributed mode are defined from a config file perspective.

0 Karma
1 Solution

jwelch_splunk
Splunk Employee
Splunk Employee

The main thing this looks at is all under the splunk_monitoring_console

lookups/assets.csv
local/splunk_monitoring_console_assets.conf

And the real kicker is normally in

/opt/splunk/etc/system/local/distsearch.conf

This is where we create all the search groups.

Okie

View solution in original post

jwelch_splunk
Splunk Employee
Splunk Employee

The main thing this looks at is all under the splunk_monitoring_console

lookups/assets.csv
local/splunk_monitoring_console_assets.conf

And the real kicker is normally in

/opt/splunk/etc/system/local/distsearch.conf

This is where we create all the search groups.

Okie

Aftend1971
Explorer

These are generated, right? Not for edit.
lookups/assets.csv
local/splunk_monitoring_console_assets.conf

But how to edit
/opt/splunk/etc/system/local/distsearch.conf
to have in DMC remote peers in 'Configured' state, not in 'New' state?

If you add manualy configuredPeers=peer:8089 to local/splunk_monitoring_console_assets.conf, it will be configured. But I guess that this is not right way.

sgao
Splunk Employee
Splunk Employee

You will need to click on Apply Change for its state to change from New to Configured.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...