What is the Difference between Splunk monitoring console and Distributed management console. How doo I access Dist. monitoring console ?
Monitoring Console is the new name for the Distributed Management Console. They are the same thing.
Hello, Rich should I enable distributed mode in my Monitoring console as suggested by another great helper?
If you have a distributed Splunk environment then, yes, the MC absolutely should be in Distributed mode. Only configure one MC, however. Put it on your License Manager or another lightly-used instance.
One more question please. I am going to change to dist. mode. But the deployment I have walked into. They hav a monitoring console on almost every Splunk server like om MC, LM, SHs etc. Should I remove most & only keep one Monitoring console in Dist. mode? Thax again
The MC is built-in to every Splunk instance (except UF). Only one of them should be in Distributed mode; the rest should be in Standalone mode. The instance you choose to be the MC should have visibility into all other instances (make them search peers).
Please show me how to make the MCs peers with the MC in distributed mode. I appreciate your time.
The MC does not peer with other MCs. It peers with other Splunk instances. Do so the same way you would peer a search head with an indexer. Go to Settings->Distributed Search and add all of the non-forwarder Splunk servers as peers to the MC. Then open the MC and select Settings->General Setup, review the server list, and click Apply Changes.
See https://docs.splunk.com/Documentation/Splunk/8.1.2/DMC/Configureindistributedmode for details.
The difference is Distributed Monitoring Console monitors your distributed deployment. You should enable Distributed mode inside the monitoring console. Please see below documentation;
One more question please reg Distributed mode in the MC. In the Splunk environment I have inherited. There are 2 Monitoring consoles both in Distributed mode, does this cause problems?
Having 2 MCs will create excess load in your Splunk environment, but should not cause real problems. Best to disable one of them, however, so you have a single source of truth and only one MC to keep current.