https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140569#M5281 <P>You should see the same daily volume, regardless of the number of indexers and the search/replication factors... provided you don't do data cloning before indexing.</P> <P>Each indexer <EM>indexes</EM> half the data, and then <EM>replicates</EM> the indexed data to its sibling indexer - that's where the fault tolerance is covered. The replication data is not tallied against the daily licensing volume because it's not re-indexed.</P> Fri, 07 Feb 2014 13:16:03 GMT martin_mueller 2014-02-07T13:16:03Z https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140566#M5278 <P>I currently have a cluster deployed in a test environment (replication factor of 2). I've been reading some of the posts here dealing with clusters and licensing, specifically the impact that 2 indexers would have on licensing. </P> <P>I've read that replicating the data would have no impact on the license, but when I look at the "licensing" information on the master, I see that both indexers are being tallied against the daily volume. </P> <P>Is there a way to change this behavior?</P> Thu, 06 Feb 2014 19:36:49 GMT https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140566#M5278 pil321 2014-02-06T19:36:49Z https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140567#M5279 <P>Both indexers are tallying against the daily volume, that's correct - for the data they receive from forwarders/inputs. Usually each indexer gets roughly half the data, and both halves are counted just like in a non-clustered load-balancing set of indexers.</P> <P>If you're seeing replication volume appear in there on top of indexing volume then something is seriously wrong... could you provide more background info?</P> Thu, 06 Feb 2014 20:30:35 GMT https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140567#M5279 martin_mueller 2014-02-06T20:30:35Z https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140568#M5280 <P>So, if I had only one indexer (not a cluster, no load-balancing), I would see the same daily volume?</P> <P>If each indexer in a cluster has half the data, I don't understand how this would work for fault tolerance (but I guess that is a bit off topic).</P> Fri, 07 Feb 2014 12:50:30 GMT https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140568#M5280 pil321 2014-02-07T12:50:30Z https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140569#M5281 <P>You should see the same daily volume, regardless of the number of indexers and the search/replication factors... provided you don't do data cloning before indexing.</P> <P>Each indexer <EM>indexes</EM> half the data, and then <EM>replicates</EM> the indexed data to its sibling indexer - that's where the fault tolerance is covered. The replication data is not tallied against the daily licensing volume because it's not re-indexed.</P> Fri, 07 Feb 2014 13:16:03 GMT https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140569#M5281 martin_mueller 2014-02-07T13:16:03Z https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140570#M5282 <P>I see. Thank you for your reply. That makes it much clearer on my end.</P> Sat, 08 Feb 2014 15:44:18 GMT https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140570#M5282 pil321 2014-02-08T15:44:18Z https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140571#M5283 <P>kudos to martin_mueller for answering this question (see comments section).</P> Sat, 08 Feb 2014 15:46:55 GMT https://community.splunk.com/t5/Deployment-Architecture/Cluster-replication-and-licensing/m-p/140571#M5283 pil321 2014-02-08T15:46:55Z