Splunk® Enterprise

Monitoring Splunk Enterprise

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Configure DMC in distributed mode

This topic is a step in the procedure for setting up the Distributed Management Console (DMC) in a multi-instance Splunk Enterprise deployment. See "Multi-instance deployment DMC setup steps."

1. Log into the instance on which you want to configure the distributed management console. The instance by default is in standalone mode, unconfigured.

2. In Splunk Web, select Distributed Management Console > Settings > General Setup.

3. Turn on distributed mode at the top left.

4. Confirm that:

  • The columns labeled instance and machine are populated correctly and populated with values that are unique within a column. Note: If your deployment has nodes running Splunk Enterprise 6.1.x (instead of 6.2.0+), their instance (host) and machine values will not be populated.
    • To find the value of machine, typically you can log into the 6.1.x instance and run hostname on *nix or Windows. Here machine represents the FQDN of the machine.
    • To find the value of instance (host), use btool: splunk cmd btool inputs list default.
    • When you know these values, in the Setup page, click Edit > Edit instance. A popup presents you with two fields to fill in: Instance (host) name and Machine name.
  • The server roles are correct, with the primary or major roles. For example, a search head that is also a license master should have both roles marked. If not, click Edit to correct.
  • A cluster master is identified if you are using indexer clustering. If not, click Edit to correct.

Caution: Make sure anything marked an indexer is really an indexer.

5. (Optional) Set custom groups. Custom groups are tags that map directly to distributed search groups. You don't need to add groups the first time you go through DMC setup (or ever). You might find groups useful, for example, if you have multisite indexer clustering (each group can consist of the indexers in one location) or an indexer cluster plus standalone peers. Custom groups are allowed to overlap. That is, one indexer can belong to multiple groups. See distributed search groups in the Distributed Search Manual.

6. Click Apply Changes at the top right of the page.

7. (Optional) Set up platform alerts.

If you add another node to your deployment later, return to Settings > General Setup and check that the items in step 4 are accurate.

Next step

To optionally monitor forwarders, see Configure forwarder monitoring.

Or to optionally enable preconfigured platform alerts, see Platform alerts.

Last modified on 25 August, 2016
Configure DMC in standalone mode
Configure forwarder monitoring for the DMC

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters