Monitoring Splunk
Highlighted

Where to put my DMC?

Path Finder

I have a 3 node search head cluster + 3 independent indexers like so:

Splunk01 - Search Head Cluster Member
Splunk02 - Indexer, Deployment Server
Splunk03 - Indexer, License Master
Splunk04 - Indexer, Deployer (for search head cluster)
Splunk05 - Search Head Cluster Member
Splunk06 - Search Head Cluster Member

I am about to upgrade to Splunk 6.3 but I don't have DMC configured and I know i'll require it, but where should I put it? I can't put it on an indexer or on a search head cluster, but I also don't want to spool up a new server for it (or a VM)

Highlighted

Re: Where to put my DMC?

Splunk Employee
Splunk Employee

There is a topic in the Distributed Management Console manual called Which instance should host the console? It has a table of recommendations based on deployment type.

Highlighted

Re: Where to put my DMC?

Path Finder

I've read it, but based on that document it looks like I can't put my DMC anywhere in my environment.

0 Karma
Highlighted

Re: Where to put my DMC?

Splunk Employee
Splunk Employee

I think Splunk03 meets these requirements from
the docs topic ChrisG linked:

"In a non-indexer-cluster environment, option 1: On the license master
You can configure the monitoring console on your license master if the following are true:

  • Your license master can handle the search workload, that is, meets or exceeds the search head reference hardware requirements. See "Reference hardware" in the Capacity Planning Manual.
  • Only Splunk Enterprise admins can access your dedicated license master."
Highlighted

Re: Where to put my DMC?

Path Finder

I thought so as well but I've been told I can't put the DMC on an indexer, can someone confirm if this is possible? my indexers are not clustered.

0 Karma
Highlighted

Re: Where to put my DMC?

Splunk Employee
Splunk Employee

Oh, you're right. "Use of the instance should be limited to DMC and these specific functions." I'll clarify that further down. Sounds like the recommendations are for you to provision a new instance for DMC (and you could probably also put the license master functions on that new instance).

Highlighted

Re: Where to put my DMC?

Esteemed Legend

The documentation is clear: DMC should be it's own search head with no other functions and no human users. There are very good reasons for this (you could mess up your search head).

0 Karma
Highlighted

Re: Where to put my DMC?

Path Finder

Understood but I have a search head cluster and as per the docs "The DMC cannot be on a search head cluster member. "

So it tells me I have to put it on license master or deployer.. both of those are on my indexers (which I am aware is non standard)

I guess to refine my question, is it possible to put the DMC on an indexer or no? if I can't then my only option is to spool up an entire server just for the DMC.

0 Karma
Highlighted

Re: Where to put my DMC?

Splunk Employee
Splunk Employee

My recommendation: Provision a new machine with decent but modest specs (4 to 8 CPU cores, 8 to 12GB of RAM) and install a brand new instance of Splunk on it.

Set up this instance as the Distributed Management Console and migrate the following supporting functions over to this new instance:

  • License master
  • App deployer
  • Deployment server, if it is serving 50 clients or less

At this point, it seems really worth it to me to move all supporting features away from your indexers (where they are not supported) and to consolidate those on a dedicated, one-stop-shop administration instance.

View solution in original post

Highlighted

Re: Where to put my DMC?

Path Finder

I wish I didn't have to spool up a whole physical server for this however it's clearly the only logical solution. Appreciate your input thanks.

0 Karma