Cluster replication and licensing

[pil321]

I currently have a cluster deployed in a test environment (replication factor of 2). I've been reading some of the posts here dealing with clusters and licensing, specifically the impact that 2 indexers would have on licensing.

I've read that replicating the data would have no impact on the license, but when I look at the "licensing" information on the master, I see that both indexers are being tallied against the daily volume.

Is there a way to change this behavior?

[pil321 · Accepted solution]

kudos to martin_mueller for answering this question (see comments section).

[pil321]

I see. Thank you for your reply. That makes it much clearer on my end.

[martin_mueller]

You should see the same daily volume, regardless of the number of indexers and the search/replication factors... provided you don't do data cloning before indexing.

Each indexer indexes half the data, and then replicates the indexed data to its sibling indexer - that's where the fault tolerance is covered. The replication data is not tallied against the daily licensing volume because it's not re-indexed.

[pil321]

So, if I had only one indexer (not a cluster, no load-balancing), I would see the same daily volume?

If each indexer in a cluster has half the data, I don't understand how this would work for fault tolerance (but I guess that is a bit off topic).

[martin_mueller]

Both indexers are tallying against the daily volume, that's correct - for the data they receive from forwarders/inputs. Usually each indexer gets roughly half the data, and both halves are counted just like in a non-clustered load-balancing set of indexers.

If you're seeing replication volume appear in there on top of indexing volume then something is seriously wrong... could you provide more background info?