Deployment Architecture

How many DMCs are needed in Active-Active Multisite architecture ?

Loves-to-Learn Lots

We are planning to build an ACTIVE-ACTIVE multisite Splunk deployment, wherein each data center will have its own cluster master along with a set of search peers and search heads.

We are confused about whether we should go with two distributed management consoles, one at each site OR if only one DMC is enough for both the sites?

Please suggest !!

0 Karma

Esteemed Legend

I would do a single global MC. If you are in a failure scenario, it is trivial to spin up a new MC from scratch, even by hand.

0 Karma


That would depend...

If you are setting up the multi-site environment because you are wanting DR or for the purpose of ensuring redundancy then you would likely want to have the monitoring setup with redundancy as well. That way if you lose a site, your monitoring will continue unfettered.

If you are setting up the multi-site environment to deal with network latency between sites or to enable search / forwarder affinity and are not worried about DR, then a single MC will likely be sufficient.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...