Should the master node be a license slave?

[dpham36]

I have 1 master node, 2 peer nodes (indexers), and a separate search head. I've set up the search head as the license master (not the master node, as recommended in the documentation), and currently the 2 peer nodes (indexers) are license slaves that point to the new license master. Should I also configure the master node as a license slave?

[lguinn2]

The master node must be a license slave. It must also be in the same pool as the indexers in the cluster.

[dpham36]

Ok great, that's what I thought (that it must be a license slave). As for the same pool - what if the indexers are in different pools? In my set up, they are all in the default 'auto_generated_pool_enterprise' (since I have the Enterprise license, and since I haven't created any custom pools), but I understand that you can set up different pools for different indexers to manage how much license volume each one is allowed to use per day...

[dpham36]

NOTE - From the documentation, I understand also that 'Any host in your Splunk Enterprise infrastructure that performs indexing must be licensed to do so. You can either run a standalone indexer with a license installed locally, or you can configure one of your Splunk Enterprise instances as a license master and set up a license pool from which other indexers, configured as license slaves, can draw. ' Will the master node be doing any indexing (meaning it will have to be turned into a license slave)?

[somesoni2]

Are you forwarding logs, including _internal logs from Master node to your Indexers? If yes than no local indexing will be happening, so you set the master node with Forwarder license. Though, setting it as license slave would not hurt.

[dpham36]

I only planned on forwarding logs to the indexers (index cluster) from separate servers that have the Splunk Universal Forwarder installed. Unless the master node automatically forwards internal logs to it's peer nodes (the indexers), then no, I am not currently forwarding _internal logs to the indexers from the master node.