I have an Indexer cluster with 4 nodes and a master, currently the four peers are the only nodes ingesting data (I'm unsure if this goes against best practice or not). I'm curious, if I start data re-balancing, will the cluster try to move data to my master? If so, is there a way to tell it to not do this?
It will only re-balance across peer nodes, read more here:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Rebalancethecluster
Hope it helps