I have set up 1 Master node, 2 Indexers (as peers), 1 Search head. My Master node acts as License master as well.
From the documentation I read - The master node coordinates the activities of the peer nodes, It does not itself store or replicate data (aside from its own internal data).
however I see the data is replicated from the peer nodes. Is this correct ?
I am on splunk version 5.0.4
Your understanding is correct. The peer nodes in the cluster maintain replicas of your data according to your configured replication factor and search factor. With 2 indexers, you probably have an RF=2 and an SF=2.
The master contains no actual index data, other than what it needs to coordinate replication between the peers. As of Splunk 5.0, the cluster master is a potential single point of failure for the whole Splunk cluster.
Yes you are right, I have RF=2 and SF=2; if I make RF=1 and SF=1 will it not replicate data in the Master ?