All Apps and Add-ons

Using Deployment Monitor app to monitor a cluster

jtworzydlo
Path Finder

As written above - are there any good practices for installing Deployment Monitor on a cluster? Is it also pushed from the master to the nodes or installed on search head?

1 Solution

jtworzydlo
Path Finder

Finally I asked this question during a Splunk Advanced Administration Course. I got the answer that the DM should be installed on the search head. However, in my case the License Manager is not a part of a cluster so to gain the licensing info, I had to add it as a peer to another search head to be queried.

View solution in original post

0 Karma

jtworzydlo
Path Finder

Finally I asked this question during a Splunk Advanced Administration Course. I got the answer that the DM should be installed on the search head. However, in my case the License Manager is not a part of a cluster so to gain the licensing info, I had to add it as a peer to another search head to be queried.

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

Have you looked at the cluster master dashboard? It provides a great deal of useful information for monitoring a cluster.

If you need more details on the health of your cluster, the S.o.S. app is a great way to go. See http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk?utm_source=featured&utm_medium=%2Fapps...

If you want to install the deployment monitor app on your peers, your only choice at this time (5.0.2) is to install it on each individual peer for monitoring only the forwarders talking to that peer. The configuration bundle method, which would allow you to install across all peers at one time, does not currently support Splunk Web components, as described here: http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/Updatepeerconfigurations#Limitations_on_cl...

I am not sure whether by installing it on the search head instead you will garner any useful information. Perhaps someone else can offer their experience with that approach.

araitz
Splunk Employee
Splunk Employee

That's a good ask. I opened DEPMON-119 for the request and linked to this answer.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...