Where to put my DMC?

[johnpof]

I have a 3 node search head cluster + 3 independent indexers like so:

Splunk01 - Search Head Cluster Member
Splunk02 - Indexer, Deployment Server
Splunk03 - Indexer, License Master
Splunk04 - Indexer, Deployer (for search head cluster)
Splunk05 - Search Head Cluster Member
Splunk06 - Search Head Cluster Member

I am about to upgrade to Splunk 6.3 but I don't have DMC configured and I know i'll require it, but where should I put it? I can't put it on an indexer or on a search head cluster, but I also don't want to spool up a new server for it (or a VM)

[hexx · Accepted solution]

My recommendation: Provision a new machine with decent but modest specs (4 to 8 CPU cores, 8 to 12GB of RAM) and install a brand new instance of Splunk on it.

Set up this instance as the Distributed Management Console and migrate the following supporting functions over to this new instance:

• License master
• App deployer
• Deployment server, if it is serving 50 clients or less

At this point, it seems really worth it to me to move all supporting features away from your indexers (where they are not supported) and to consolidate those on a dedicated, one-stop-shop administration instance.

[johnpof]

I wish I didn't have to spool up a whole physical server for this however it's clearly the only logical solution. Appreciate your input thanks.

[woodcock]

The documentation is clear: DMC should be it's own search head with no other functions and no human users. There are very good reasons for this (you could mess up your search head).

[johnpof]

Understood but I have a search head cluster and as per the docs "The DMC cannot be on a search head cluster member. "

So it tells me I have to put it on license master or deployer.. both of those are on my indexers (which I am aware is non standard)

I guess to refine my question, is it possible to put the DMC on an indexer or no? if I can't then my only option is to spool up an entire server just for the DMC.

[ChrisG]

There is a topic in the Distributed Management Console manual called Which instance should host the console? It has a table of recommendations based on deployment type.

[johnpof]

I've read it, but based on that document it looks like I can't put my DMC anywhere in my environment.

[jlaw]

I think Splunk03 meets these requirements from
the docs topic ChrisG linked:

"In a non-indexer-cluster environment, option 1: On the license master
You can configure the monitoring console on your license master if the following are true:

• Your license master can handle the search workload, that is, meets or exceeds the search head reference hardware requirements. See "Reference hardware" in the Capacity Planning Manual.
• Only Splunk Enterprise admins can access your dedicated license master."

[johnpof]

I thought so as well but I've been told I can't put the DMC on an indexer, can someone confirm if this is possible? my indexers are not clustered.

[jlaw]

Oh, you're right. "Use of the instance should be limited to DMC and these specific functions." I'll clarify that further down. Sounds like the recommendations are for you to provision a new instance for DMC (and you could probably also put the license master functions on that new instance).