Deployment Architecture

Cluster replication and licensing

pil321
Communicator

I currently have a cluster deployed in a test environment (replication factor of 2). I've been reading some of the posts here dealing with clusters and licensing, specifically the impact that 2 indexers would have on licensing.

I've read that replicating the data would have no impact on the license, but when I look at the "licensing" information on the master, I see that both indexers are being tallied against the daily volume.

Is there a way to change this behavior?

Tags (2)
0 Karma
1 Solution

pil321
Communicator

kudos to martin_mueller for answering this question (see comments section).

View solution in original post

pil321
Communicator

kudos to martin_mueller for answering this question (see comments section).

pil321
Communicator

I see. Thank you for your reply. That makes it much clearer on my end.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You should see the same daily volume, regardless of the number of indexers and the search/replication factors... provided you don't do data cloning before indexing.

Each indexer indexes half the data, and then replicates the indexed data to its sibling indexer - that's where the fault tolerance is covered. The replication data is not tallied against the daily licensing volume because it's not re-indexed.

pil321
Communicator

So, if I had only one indexer (not a cluster, no load-balancing), I would see the same daily volume?

If each indexer in a cluster has half the data, I don't understand how this would work for fault tolerance (but I guess that is a bit off topic).

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Both indexers are tallying against the daily volume, that's correct - for the data they receive from forwarders/inputs. Usually each indexer gets roughly half the data, and both halves are counted just like in a non-clustered load-balancing set of indexers.

If you're seeing replication volume appear in there on top of indexing volume then something is seriously wrong... could you provide more background info?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...