Difference between Splunk monitoring console and Distributed management console

[SamHTexas]

What is the Difference between Splunk monitoring console and Distributed management console. How doo I access Dist. monitoring console ?

[richgalloway]

Monitoring Console is the new name for the Distributed Management Console.  They are the same thing.

[SamHTexas]

Hello, Rich should I enable distributed mode in my Monitoring console as suggested by another great helper?

[richgalloway]

If you have a distributed Splunk environment then, yes, the MC absolutely should be in Distributed mode.  Only configure one MC, however.  Put it on your License Manager or another lightly-used instance.

[SamHTexas]

One more question please. I am going to change to dist. mode. But the deployment I have walked into. They hav a monitoring console on almost every Splunk server like om MC, LM, SHs etc. Should I remove most & only keep one Monitoring console in Dist. mode? Thax again

[richgalloway]

The MC is built-in to every Splunk instance (except UF).  Only one of them should be in Distributed mode; the rest should be in Standalone mode.  The instance you choose to be the MC should have visibility into all other instances (make them search peers).

[SamHTexas]

Please show me how to make the MCs peers with the MC in distributed mode. I appreciate your time.

[richgalloway]

The MC does not peer with other MCs.  It peers with other Splunk instances.  Do so the same way you would peer a search head with an indexer.  Go to Settings->Distributed Search and add all of the non-forwarder Splunk servers as peers to the MC.  Then open the MC and select Settings->General Setup, review the server list, and click Apply Changes.

See https://docs.splunk.com/Documentation/Splunk/8.1.2/DMC/Configureindistributedmode for details.

[scelikok]

Hi @SamHTexas,

The difference is Distributed Monitoring Console monitors your distributed deployment. You should enable Distributed mode inside the monitoring console. Please see below documentation;

https://docs.splunk.com/Documentation/Splunk/8.1.2/DMC/Configureindistributedmode 

[SamHTexas]

One more question please reg Distributed mode in the MC. In the Splunk environment I have inherited. There are 2 Monitoring consoles both in Distributed mode, does this cause problems?

[richgalloway]

Having 2 MCs will create excess load in your Splunk environment, but should not cause real problems.  Best to disable one of them, however, so you have a single source of truth and only one MC to keep current.