Deployment Architecture

Master node data replication

Path Finder

I have set up 1 Master node, 2 Indexers (as peers), 1 Search head. My Master node acts as License master as well.

From the documentation I read - The master node coordinates the activities of the peer nodes, It does not itself store or replicate data (aside from its own internal data).

however I see the data is replicated from the peer nodes. Is this correct ?

I am on splunk version 5.0.4

Tags (2)

SplunkTrust
SplunkTrust

Your understanding is correct. The peer nodes in the cluster maintain replicas of your data according to your configured replication factor and search factor. With 2 indexers, you probably have an RF=2 and an SF=2.

The master contains no actual index data, other than what it needs to coordinate replication between the peers. As of Splunk 5.0, the cluster master is a potential single point of failure for the whole Splunk cluster.

0 Karma

Path Finder

Yes you are right, I have RF=2 and SF=2; if I make RF=1 and SF=1 will it not replicate data in the Master ?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!