Deployment Architecture

Why is the search result still duplicate after the indexer cluster failure is repaired?

bestSplunker
Contributor

hey guys

I have a single site cluster contain 5 peer node 、4 search header 、1 cluster master 、1 deploye.

there are 3 peers and 1 sh were down for some reason at midnight,until this morning . peers and search restored are normal.all data is searchable、search factor is met and replication factor is met and remove all excess bukets.

before the cluster failure repair, the search results have no duplication events,
when the cluster failure occurs, the search results have a large number of errors and repeated events,
The phenomenon of duplicate events is still happening after the cluster failure repaired.

Why is the search result still duplicate after the indexer cluster failure is repaired? What should I do to working normally?

0 Karma

bestSplunker
Contributor

if I restart heavy forwarder, The phenomenon of duplication events will disappear? why?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...