Getting Data In

Indexer with high IO

italogf
Explorer

Hello, I have the following question.

I have in my environment 4 index servers and 2 search head.

I also have 2 licenses 100GB and 2 license master servers. Each with 100GB

Lately my splunk has been very slow, I noticed that the license servers are with IO much higher than the other two, I came to cogitate be the balancer but the configuration is correct.

The only thing I have different is that 2 servers are as indexer and master license and the other 2 just as indexer.

I use distributed search so my file $SPLUNK_HOME / etc and $ SPLUNK_HOME / var are shared on an NFS.

I have a high volume of searches and simultaneous users logged.

I do not use all my 200GB license, I'm using only 140GB

Can you give me an idea?

Tags (2)
0 Karma
1 Solution

lukejadamec
Super Champion

You probably don't want to use two license masters. If you must, then you should probably contact splunk support.

One license master works fine so long as it is on-line and communicating to the other servers at least once between mid-night and mid-night on any particular day.

View solution in original post

0 Karma

lukejadamec
Super Champion

You probably don't want to use two license masters. If you must, then you should probably contact splunk support.

One license master works fine so long as it is on-line and communicating to the other servers at least once between mid-night and mid-night on any particular day.

0 Karma

italogf
Explorer

Thank you for your reply. I will try contact the support and i will install a dedicated license master server.

But still I find it strange slowness of searches .. I have noticed that the splunk-system-user user runs at least 20x more searches than the normal user.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...