topic enterprise security notable are not same on all 3 SH enterprise security. in Splunk Enterprise

enterprise security notable are not same on all 3 SH enterprise security.

AShwin1119 — Fri, 24 Jan 2025 15:01:21 GMT

We have SH cluster of 3 SH, where enterprise security notable are not same on all 3 SH enterprise security. And further when we check for last 15 min internal data that also vary with significant number (5 K to 10 k) than other 2 SH Member.

Re: enterprise security notable are not same on all 3 SH enterprise security.

gcusello — Fri, 24 Jan 2025 15:45:34 GMT

Hi @AShwin1119 ,

it's really strange, probably therewas some replication issue, did you checked the status of replication in the Cluster Manager Console?

Had you some stop of one or more of the indexers?

Have you a multisite or a single site Indexers Cluster?

If it's all OK, open a case to Splunk Support.

Ciao.

Giuseppe

Re: enterprise security notable are not same on all 3 SH enterprise security.

PickleRick — Fri, 24 Jan 2025 15:48:03 GMT

OK. Check shcluster-status. Check splunkd.log on those instances (and mongodb.log). If the state of the SHC is not in sync... that means something is off with replication or the overall cluster health.

Re: enterprise security notable are not same on all 3 SH enterprise security.

VatsalJagani — Sat, 25 Jan 2025 08:28:40 GMT

@AShwin1119- I think its the same question here I have answered - https://community.splunk.com/t5/Monitoring-Splunk/indexer-cluster-to-SH-cluster-replication-issue/m-p/709746/highlight/true#M10687

I think you are not forwarding the SH data to Indexers.

* Which is compulsory when you are using SHC.

* And best-practice in all SHs.

https://docs.splunk.com/Documentation/Splunk/9.4.0/DistSearch/Forwardsearchheaddata

I hope this helps!!! Kindly upvote if it does!!!!