Deployment Architecture

Monitoring Console(MC) and Clustered Indexers. MC is only seeing indexers on one site meanwhile cluster includes two sites

santorof
Path Finder

Have a server that performs my indexer clustering where my 20 indexers(10 per site) check in. On my monitoring console I wanted to check on each machines health but I only see 10 of my indexers from site 1 and not my other 10 indexers from site 2. The cluster master machine is on the same subnet as site 1 whereas site 2 is on another subnet. I dont see this as a potential issue though because my site 2 indexers are able to communicate with the master and replicate without issue(meeting all factors).

Are there any settings I need to change on my cluster master or my site 2 indexers?

0 Karma
1 Solution

koshyk
Super Champion

You have to change this setting in the server which hosts your DMC (MC).

You can either do it via the server which contains the Monitoring Console UI

Main Splunk -> Settings -> Distributed search » Search peers   and add/authenticate your indexers which are missing
Then in the MC,  Settings -> Distributed -> Apply Changes  (Ensure all the indexers are in the list below and roles are correct)

or via distsearch.conf entry like below

[distributedSearch:dmc_group_indexer]
servers =    https://indexer-slave-01:8089 , https://indexer-slave-02:8089 , https://indexer-slave-03:8089 , https://indexer-slave-04:8089

[distributedSearch:dmc_indexerclustergroup_my_idx_cluster1]
servers = localhost:localhost,   https://indexer-slave-01:8089 , https://indexer-slave-02:8089 , https://indexer-slave-03:8089 , https://indexer-slave-04:8089

View solution in original post

koshyk
Super Champion

You have to change this setting in the server which hosts your DMC (MC).

You can either do it via the server which contains the Monitoring Console UI

Main Splunk -> Settings -> Distributed search » Search peers   and add/authenticate your indexers which are missing
Then in the MC,  Settings -> Distributed -> Apply Changes  (Ensure all the indexers are in the list below and roles are correct)

or via distsearch.conf entry like below

[distributedSearch:dmc_group_indexer]
servers =    https://indexer-slave-01:8089 , https://indexer-slave-02:8089 , https://indexer-slave-03:8089 , https://indexer-slave-04:8089

[distributedSearch:dmc_indexerclustergroup_my_idx_cluster1]
servers = localhost:localhost,   https://indexer-slave-01:8089 , https://indexer-slave-02:8089 , https://indexer-slave-03:8089 , https://indexer-slave-04:8089

amithtelkar01
Engager

Buy You a Beer ! Thanks

0 Karma

santorof
Path Finder

Looking into Distributed search I thought that the other indexers were added since my cluster server is considered a search head but thats not the case. I have added my other indexers to DS and everything looks great. Thanks!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...