Deployment Architecture

Why is the search result still duplicate after the indexer cluster failure is repaired?

bestSplunker
Contributor

hey guys

I have a single site cluster contain 5 peer node 、4 search header 、1 cluster master 、1 deploye.

there are 3 peers and 1 sh were down for some reason at midnight,until this morning . peers and search restored are normal.all data is searchable、search factor is met and replication factor is met and remove all excess bukets.

before the cluster failure repair, the search results have no duplication events,
when the cluster failure occurs, the search results have a large number of errors and repeated events,
The phenomenon of duplicate events is still happening after the cluster failure repaired.

Why is the search result still duplicate after the indexer cluster failure is repaired? What should I do to working normally?

0 Karma

bestSplunker
Contributor

if I restart heavy forwarder, The phenomenon of duplication events will disappear? why?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...