Deployment Architecture

What are ideal role placements for Deployer, Deployment Server, & Distributed Management Console in our multisite indexer & search head clustering environment?


I've recently created a new multisite indexer and search head cluster topology, using separate VM''s for my license server and cluster master. I have an additional VM which I am going to use for one, or all of the following roles:

Deployment Server

I am considering one of two options:

Option A:

Place all three (Deployer, Deployment Server & DMC) onto my remaining VM.

Option B:
Place my Deployment Server on my Cluster Master
Place my Deployer on my License Master
Place my DMC by itself on the new VM

I should point out that my Cluster Master serves as Indexer Cluster Master, as well as Search Head Cluster Master (not even sure if these can be separate)

Any thoughts suggestions?

Thank you in advance,


0 Karma

Splunk Employee
Splunk Employee

Both options should work fine. Here's the reference doc:

Two things to note though:

  • DMC instance is required to be a search head of the indexer cluster, which means in either Option A or Option B, you need to convert DMC instance to a search head by clicking "Settings -> indexer cluster", then enable indexer cluster and choose role as search head node, point this instance to the indexer cluster master.
  • DMC instance is required to NOT be a search head cluster member. Actually DMC will be disabled on search head cluster members. So in your case, the DMC instance will be part of the indexer cluster but cannot be part of the search head cluster.
Get Updates on the Splunk Community!

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...