Hello Splunk - we have two indexers and one search node (acting as license master). We noticed the search node showing we maxed out our 5g license by %250. If every indexer receives less than 5g shouldnt be ok? or is the sum of traffic on each indexer what is counted? thank you for clarifying this !
Your license needs to be greater than the sum of data indexed by ALL indexers, not counting replication (if used). It also doesn't count internal indexes (_*) and summary indexes.
--- If this reply helps you, Karma would be appreciated.
