Ok great, that's what I thought (that it must be a license slave). As for the same pool - what if the indexers are in different pools? In my set up, they are all in the default 'auto_generated_pool_enterprise' (since I have the Enterprise license, and since I haven't created any custom pools), but I understand that you can set up different pools for different indexers to manage how much license volume each one is allowed to use per day... ... View more

I only planned on forwarding logs to the indexers (index cluster) from separate servers that have the Splunk Universal Forwarder installed. Unless the master node automatically forwards internal logs to it's peer nodes (the indexers), then no, I am not currently forwarding _internal logs to the indexers from the master node. ... View more

NOTE - From the documentation, I understand also that 'Any host in your Splunk Enterprise infrastructure that performs indexing must be licensed to do so. You can either run a standalone indexer with a license installed locally, or you can configure one of your Splunk Enterprise instances as a license master and set up a license pool from which other indexers, configured as license slaves, can draw. ' Will the master node be doing any indexing (meaning it will have to be turned into a license slave)? ... View more