Monitoring Splunk

Where to put my DMC?

johnpof
Path Finder

I have a 3 node search head cluster + 3 independent indexers like so:

Splunk01 - Search Head Cluster Member
Splunk02 - Indexer, Deployment Server
Splunk03 - Indexer, License Master
Splunk04 - Indexer, Deployer (for search head cluster)
Splunk05 - Search Head Cluster Member
Splunk06 - Search Head Cluster Member

I am about to upgrade to Splunk 6.3 but I don't have DMC configured and I know i'll require it, but where should I put it? I can't put it on an indexer or on a search head cluster, but I also don't want to spool up a new server for it (or a VM)

1 Solution

hexx
Splunk Employee
Splunk Employee

My recommendation: Provision a new machine with decent but modest specs (4 to 8 CPU cores, 8 to 12GB of RAM) and install a brand new instance of Splunk on it.

Set up this instance as the Distributed Management Console and migrate the following supporting functions over to this new instance:

  • License master
  • App deployer
  • Deployment server, if it is serving 50 clients or less

At this point, it seems really worth it to me to move all supporting features away from your indexers (where they are not supported) and to consolidate those on a dedicated, one-stop-shop administration instance.

View solution in original post

hexx
Splunk Employee
Splunk Employee

My recommendation: Provision a new machine with decent but modest specs (4 to 8 CPU cores, 8 to 12GB of RAM) and install a brand new instance of Splunk on it.

Set up this instance as the Distributed Management Console and migrate the following supporting functions over to this new instance:

  • License master
  • App deployer
  • Deployment server, if it is serving 50 clients or less

At this point, it seems really worth it to me to move all supporting features away from your indexers (where they are not supported) and to consolidate those on a dedicated, one-stop-shop administration instance.

johnpof
Path Finder

I wish I didn't have to spool up a whole physical server for this however it's clearly the only logical solution. Appreciate your input thanks.

0 Karma

woodcock
Esteemed Legend

The documentation is clear: DMC should be it's own search head with no other functions and no human users. There are very good reasons for this (you could mess up your search head).

0 Karma

johnpof
Path Finder

Understood but I have a search head cluster and as per the docs "The DMC cannot be on a search head cluster member. "

So it tells me I have to put it on license master or deployer.. both of those are on my indexers (which I am aware is non standard)

I guess to refine my question, is it possible to put the DMC on an indexer or no? if I can't then my only option is to spool up an entire server just for the DMC.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

There is a topic in the Distributed Management Console manual called Which instance should host the console? It has a table of recommendations based on deployment type.

johnpof
Path Finder

I've read it, but based on that document it looks like I can't put my DMC anywhere in my environment.

0 Karma

jlaw
Splunk Employee
Splunk Employee

I think Splunk03 meets these requirements from
the docs topic ChrisG linked:

"In a non-indexer-cluster environment, option 1: On the license master
You can configure the monitoring console on your license master if the following are true:

  • Your license master can handle the search workload, that is, meets or exceeds the search head reference hardware requirements. See "Reference hardware" in the Capacity Planning Manual.
  • Only Splunk Enterprise admins can access your dedicated license master."

johnpof
Path Finder

I thought so as well but I've been told I can't put the DMC on an indexer, can someone confirm if this is possible? my indexers are not clustered.

0 Karma

jlaw
Splunk Employee
Splunk Employee

Oh, you're right. "Use of the instance should be limited to DMC and these specific functions." I'll clarify that further down. Sounds like the recommendations are for you to provision a new instance for DMC (and you could probably also put the license master functions on that new instance).

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...