topic Re: Indexer with high IO in Getting Data In

Indexer with high IO

italogf — Mon, 28 Sep 2020 16:15:29 GMT

Hello, I have the following question.

I have in my environment 4 index servers and 2 search head.

I also have 2 licenses 100GB and 2 license master servers. Each with 100GB

Lately my splunk has been very slow, I noticed that the license servers are with IO much higher than the other two, I came to cogitate be the balancer but the configuration is correct.

The only thing I have different is that 2 servers are as indexer and master license and the other 2 just as indexer.

I use distributed search so my file $SPLUNK_HOME / etc and $ SPLUNK_HOME / var are shared on an NFS.

I have a high volume of searches and simultaneous users logged.

I do not use all my 200GB license, I'm using only 140GB

Can you give me an idea?

Re: Indexer with high IO

lukejadamec — Fri, 28 Mar 2014 00:22:51 GMT

You probably don't want to use two license masters. If you must, then you should probably contact splunk support.

One license master works fine so long as it is on-line and communicating to the other servers at least once between mid-night and mid-night on any particular day.

Re: Indexer with high IO

italogf — Fri, 28 Mar 2014 11:30:53 GMT

Thank you for your reply. I will try contact the support and i will install a dedicated license master server.

But still I find it strange slowness of searches .. I have noticed that the splunk-system-user user runs at least 20x more searches than the normal user.