Deployment Architecture

Master node data replication

msn2507
Path Finder

I have set up 1 Master node, 2 Indexers (as peers), 1 Search head. My Master node acts as License master as well.

From the documentation I read - The master node coordinates the activities of the peer nodes, It does not itself store or replicate data (aside from its own internal data).

however I see the data is replicated from the peer nodes. Is this correct ?

I am on splunk version 5.0.4

Tags (2)

dwaddle
SplunkTrust
SplunkTrust

Your understanding is correct. The peer nodes in the cluster maintain replicas of your data according to your configured replication factor and search factor. With 2 indexers, you probably have an RF=2 and an SF=2.

The master contains no actual index data, other than what it needs to coordinate replication between the peers. As of Splunk 5.0, the cluster master is a potential single point of failure for the whole Splunk cluster.

0 Karma

msn2507
Path Finder

Yes you are right, I have RF=2 and SF=2; if I make RF=1 and SF=1 will it not replicate data in the Master ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...