Deployment Architecture

Master node data replication

msn2507
Path Finder

I have set up 1 Master node, 2 Indexers (as peers), 1 Search head. My Master node acts as License master as well.

From the documentation I read - The master node coordinates the activities of the peer nodes, It does not itself store or replicate data (aside from its own internal data).

however I see the data is replicated from the peer nodes. Is this correct ?

I am on splunk version 5.0.4

Tags (2)

dwaddle
SplunkTrust
SplunkTrust

Your understanding is correct. The peer nodes in the cluster maintain replicas of your data according to your configured replication factor and search factor. With 2 indexers, you probably have an RF=2 and an SF=2.

The master contains no actual index data, other than what it needs to coordinate replication between the peers. As of Splunk 5.0, the cluster master is a potential single point of failure for the whole Splunk cluster.

0 Karma

msn2507
Path Finder

Yes you are right, I have RF=2 and SF=2; if I make RF=1 and SF=1 will it not replicate data in the Master ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...