I currently have a cluster deployed in a test environment (replication factor of 2). I've been reading some of the posts here dealing with clusters and licensing, specifically the impact that 2 indexers would have on licensing.
I've read that replicating the data would have no impact on the license, but when I look at the "licensing" information on the master, I see that both indexers are being tallied against the daily volume.
Is there a way to change this behavior?
You should see the same daily volume, regardless of the number of indexers and the search/replication factors... provided you don't do data cloning before indexing.
Each indexer indexes half the data, and then replicates the indexed data to its sibling indexer - that's where the fault tolerance is covered. The replication data is not tallied against the daily licensing volume because it's not re-indexed.
So, if I had only one indexer (not a cluster, no load-balancing), I would see the same daily volume?
If each indexer in a cluster has half the data, I don't understand how this would work for fault tolerance (but I guess that is a bit off topic).
Both indexers are tallying against the daily volume, that's correct - for the data they receive from forwarders/inputs. Usually each indexer gets roughly half the data, and both halves are counted just like in a non-clustered load-balancing set of indexers.
If you're seeing replication volume appear in there on top of indexing volume then something is seriously wrong... could you provide more background info?