Deployment Architecture

Cluster replication and licensing

pil321
Communicator

I currently have a cluster deployed in a test environment (replication factor of 2). I've been reading some of the posts here dealing with clusters and licensing, specifically the impact that 2 indexers would have on licensing.

I've read that replicating the data would have no impact on the license, but when I look at the "licensing" information on the master, I see that both indexers are being tallied against the daily volume.

Is there a way to change this behavior?

Tags (2)
0 Karma
1 Solution

pil321
Communicator

kudos to martin_mueller for answering this question (see comments section).

View solution in original post

pil321
Communicator

kudos to martin_mueller for answering this question (see comments section).

pil321
Communicator

I see. Thank you for your reply. That makes it much clearer on my end.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You should see the same daily volume, regardless of the number of indexers and the search/replication factors... provided you don't do data cloning before indexing.

Each indexer indexes half the data, and then replicates the indexed data to its sibling indexer - that's where the fault tolerance is covered. The replication data is not tallied against the daily licensing volume because it's not re-indexed.

pil321
Communicator

So, if I had only one indexer (not a cluster, no load-balancing), I would see the same daily volume?

If each indexer in a cluster has half the data, I don't understand how this would work for fault tolerance (but I guess that is a bit off topic).

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Both indexers are tallying against the daily volume, that's correct - for the data they receive from forwarders/inputs. Usually each indexer gets roughly half the data, and both halves are counted just like in a non-clustered load-balancing set of indexers.

If you're seeing replication volume appear in there on top of indexing volume then something is seriously wrong... could you provide more background info?

0 Karma
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...