Indexer with high IO

[italogf]

Hello, I have the following question.

I have in my environment 4 index servers and 2 search head.

I also have 2 licenses 100GB and 2 license master servers. Each with 100GB

Lately my splunk has been very slow, I noticed that the license servers are with IO much higher than the other two, I came to cogitate be the balancer but the configuration is correct.

The only thing I have different is that 2 servers are as indexer and master license and the other 2 just as indexer.

I use distributed search so my file $SPLUNK_HOME / etc and $ SPLUNK_HOME / var are shared on an NFS.

I have a high volume of searches and simultaneous users logged.

I do not use all my 200GB license, I'm using only 140GB

Can you give me an idea?

[lukejadamec · Accepted solution]

You probably don't want to use two license masters. If you must, then you should probably contact splunk support.

One license master works fine so long as it is on-line and communicating to the other servers at least once between mid-night and mid-night on any particular day.

[italogf]

Thank you for your reply. I will try contact the support and i will install a dedicated license master server.

But still I find it strange slowness of searches .. I have noticed that the splunk-system-user user runs at least 20x more searches than the normal user.