Hello, I have the following question.
I have in my environment 4 index servers and 2 search head.
I also have 2 licenses 100GB and 2 license master servers. Each with 100GB
Lately my splunk has been very slow, I noticed that the license servers are with IO much higher than the other two, I came to cogitate be the balancer but the configuration is correct.
The only thing I have different is that 2 servers are as indexer and master license and the other 2 just as indexer.
I use distributed search so my file $SPLUNK_HOME / etc and $ SPLUNK_HOME / var are shared on an NFS.
I have a high volume of searches and simultaneous users logged.
I do not use all my 200GB license, I'm using only 140GB
Can you give me an idea?
You probably don't want to use two license masters. If you must, then you should probably contact splunk support.
One license master works fine so long as it is on-line and communicating to the other servers at least once between mid-night and mid-night on any particular day.
You probably don't want to use two license masters. If you must, then you should probably contact splunk support.
One license master works fine so long as it is on-line and communicating to the other servers at least once between mid-night and mid-night on any particular day.
Thank you for your reply. I will try contact the support and i will install a dedicated license master server.
But still I find it strange slowness of searches .. I have noticed that the splunk-system-user user runs at least 20x more searches than the normal user.