Deployment Architecture

Master node data replication

Path Finder

I have set up 1 Master node, 2 Indexers (as peers), 1 Search head. My Master node acts as License master as well.

From the documentation I read - The master node coordinates the activities of the peer nodes, It does not itself store or replicate data (aside from its own internal data).

however I see the data is replicated from the peer nodes. Is this correct ?

I am on splunk version 5.0.4

Tags (2)


Your understanding is correct. The peer nodes in the cluster maintain replicas of your data according to your configured replication factor and search factor. With 2 indexers, you probably have an RF=2 and an SF=2.

The master contains no actual index data, other than what it needs to coordinate replication between the peers. As of Splunk 5.0, the cluster master is a potential single point of failure for the whole Splunk cluster.

0 Karma

Path Finder

Yes you are right, I have RF=2 and SF=2; if I make RF=1 and SF=1 will it not replicate data in the Master ?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!