DMC picks up incorrect server roles

[saranya_fmr]

Hi I was in the verge of setting up the DMC console in 6.5.2 version on the Deployer.

I set up the internal log forwarding from all the splunk nodes i.e Cluster master . Deployment server , Search Head and License Master.

However I see DMC picking multiple server roles for a host like seen below. I edited the server role and applied the changes , but then somehow this reverts to the below warnings. Am I missing out something here?
For example the host 256628 is only a Cluster master , but DMC picks up other roles like below.
Could someone please guide?

[jensenh1999]

This is still and issue in version 7.1.2

[sloshburch]

Hi @jensenh1999 - by "issue" do you mean that the MC auto-assigns in a greedy fashion OR that even after you make settings those assignments revert back?

[sloshburch]

The DMC will do its best to guess the roles. It's very normal and by design for you to then toggle those. Even after changing them, pay attention to the pop ups as they ask you to confirm if you DO want to change the roles.

The warnings are expected because the servers have roles that are probably not accurate. For example, you likely don't have two Deployment Servers so change the roles of those accordingly. Similarly, in your distributed environment, an indexer is NOT also a search head.

Make sense?

[saranya_fmr]

Hi @SloshBurch ,

Since we have a two site architecture , I mentioned both the deployment servers etc..

Yes I did edit the server roles and assigned them correctly and applied the changes and saved it.
But noticed that a splunk restart on the host(deployer) brings it back to original state with those incorrect assignments.

[sloshburch]

That does sound weird. Before going too deep here, please make sure to follow up on the request from support. I understand that this answers thread is a byproduct of a case you have open. As such, I want to make sure you don't over-investigate this while moving the DMC may not be necessary.

[saranya_fmr]

Hi @SloshBurch ,

Infact even on the License server it shows multiple server roles.
And w.r.t the support request , Im not able to view any supoort cases other than those submitted by me.
Have asked Jim to respond to it and yes, the query you provided does match with the license manager.

[sloshburch]

Hi @saranya_fmr, I understand that the support request is resolved and as such I assume you are not moving the DMC. Is that correct? Is this working on the old DMC instance?

[saranya_fmr]

Hi @SloshBurch ,

Im am setting up the DMC on the license Master since the old wasnt set up properly.
Im facing this multiple server roles on the License Master DMC.

[sloshburch]

Ok thanks for validating. That is totally strange behavior and perhaps needs a support case.

Before that, would you do a sanity check and validate a few things:

• try reproducing it on a standalone instance with the latest version of Splunk. I'd suggest just installing an instance on your local machine and try changing the roles of the standalone instance to see if the UI behaves different
• The license instance should be made a searcher of the indexer cluster. That will add the indexers on the Search Peers page. Make sure you didn't also add them there manually since that would cause duplication.

If there's nothing promising there, then when you open the support case, make sure to include a diag from that instance as well as one you try changing the role of. Of course, include very detailed steps, screenshots, and suggestion of when to do a webex to demonstrate it.

[saranya_fmr]

Hi @SloshBurch ,

I reset the entire settings and edited the server roles and applied the changes. As of now it looks good.
But not sure if a splunk restart on the license host will change it.
I will monitor for few more days and validate it.
Thankyou for your constant support

[sloshburch]

Oh interesting. Yea, let us know.

[walterk82]

Any updates? I'm facing the same problem when the shcluster is restarted the DMC shows that it is in the "indexer" role

[sloshburch]

@walterk82 - are you implying that the DMC is running on the shc? Maybe add some screen shots to clarify where it show's that it's an 'indexer' so we can validate if the same. Sounds like this thread was attributed to a misconfiguration.

[adonio]

hello there,
did you enable DMC as distributed before assigning the roles to server and configuring outputs on all Splunk instances?

[saranya_fmr]

Hi @adonio ,

Yes I did select it as Distributed mode.

[adonio]

try and reset the DMC by navigate to settings -> MC (or DMC) -> settings -> General setup -> Reset all settings
then re enable it and follow @SloshBurch answer here to accomplish