Getting Data In

How can I monitor the indexers in cluster via DMC?

tom8h
Explorer

Hello,

I would like to know how to configure the DMC to monitor the indexers in the indexer cluster.

In my understanding, the indexers (peer nodes) should not be registered to the DMC and the cluster master only has to be registered in the indexer cluster. But the DMC default alert function such as "Abnormal State of Indexer Processor" searches "splunk_server_group=dmc_group_indexer".
"dmc_group_indexer" is defined at assets.csv file which is configured when the distributed search peer is changed, and "dmc_group_indexer" field should include the indexers information.
However, in the indexer cluster environment, the indexers are not DMC's distributed search peers because the DMC has only cluster master so the result of "splunk_server_group=dmc_group_indexer" shows "No results found".

Is my understanding correct?
Could you kindly tell me what to do for monitoring indexers in the indexer cluster?

0 Karma

asimagu
Builder

I think you need to set up the indexers as peers in the DMC instance first because you will be searching the _introspection index when you use the DMC dashboards.

Then later you need to register the indexer nodes as well as the cluster master in the DMC settings. Pick the right server role from the list
https://docs.splunk.com/Documentation/Splunk/6.5.3/DMC/Configureindistributedmode

0 Karma

Bhjindal
New Member

Were you able to fix this ? I am facing same issue.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...