We are building the splunk clustered environment for dev environment. We have a License Master setup. We want the Monitoring console to be setup on the same License master instance. Please let me know what are the steps to be followed for that?
Thanks in advance.
The process is the same no matter where you install the MC. See https://docs.splunk.com/Documentation/Splunk/8.0.0/DMC/Configureindistributedmode for the instructions.
@richgalloway , thanks for the quick reply. So, I just need to login to the License Master GUI and follow the steps? Just want to make sure.
That is correct. You will need credentials for all of the other instances so you can add them as search peers.
Search peers and ensure that ALL Splunk infrastructure nodes are peers. When you peer the
Cluster Master, the Indexers should peer in, but if not, add those, too.
Monitoring Console ->
General Setup and select
Distributed Mode then edit each peer to manually assign the correct roles. Click
Apply and then PROFIT!!!
@woodcock , but the monitoring console is to be shared with License master. The clustered indexers cannot be added.For monitoring an indexer cluster and you are hosting the monitoring console on an instance other than the cluster master, you must add the cluster master as a search peer and you must configure the monitoring console instance as a search-head in that cluster.
So, I believe in my case the License master needs to be added as a search head cluster as the DMC needs to be configured in this same instance.
So, Can the License master be added as a search head cluster?
You are mixing up concepts and terms. There is no such thing as a
management console so I have no idea what you mean there. A
License Master already IS a
Search Head, it just doesn't have any peers by default and you need to change that in order for it to also become the
Monitoring Console. I have done this many times. Just add the peers (either directly, or via the
Cluster Master) and run the setup.
I am sorry, just corrected the "management" to "monitoring". What I meant is that the clustered indexers cannot be added to the search peers directly in the splunk instance web where monioring console needs to be setup. The cluster master needs to be added as a search peer in the monitoring console. Please correct me if I am wrong here.
You can do either; it is your choice. Personally, I don't trust the
Cluster Master and I directly peer. Old habits die hard but you do you.