Getting Data In

Scheduled scans are not load balancing across cluster and crashing the Indexer they get sent to.

Aixia
Engager

I have a cluster of 4 indexers.
The search head sends scheduled scans which always end up draining resources on one indexer out of the cluster and crashing it.

How can I get the searches distributed across the cluster?

0 Karma

yannK
Splunk Employee
Splunk Employee

If you have an indexer replication cluster, but see the search running only on the same indexers, then it can be that :

  • the ingestion of your data is not loadbalanced accross all indexers, so the same indexer always get the primary searchable buckets.
    check on the cluster-master with the SOS app on the replication dashboard, where your searchable buckets are.

  • Or maybe did you setup site replication, and because of the search affinity the search-head always search on the searchable buckets that are on the indexers on the same site. So maybe always the same.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Is it always the same Indexer? Is the Search head configured to search the Cluster and not the single indexer? If the only indexer going down is the same one every time there might be bigger issue.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...