Deployment Architecture

Different number of buckets on cluster

mvagionakis
Path Finder

Hello all,

I have a "problem" with a new indexer added in my cluster.
My cluster has two indexers.
The goal is to replace these two indexers by two other with more resources.

So here what I did:

1) realize all the configurations in indexes.conf, server.conf etc
2) add the new indexer in my cluster
3) shut down and remove from the cluster the old indexer
4) wait for the replication finishing.

The problem is that, once replication finished, I have an important number of buckets that missing.
My new server in the cluster has 9500 buckets and the old one, 11500.

When I launch a research for the same time period on the same index but on the new and the second old server, I don't have the same number of results.

I tried the "data rebalance" but nothing...everything is green in the Master node under Indexer clustering.

Is there anyway to force the missing bucket replication?

edit: I've just realized that the problem was already there before the addition of the new server. The removed server has lowest bucket number and lower events in the indexes.

Thank you in advance.
Michael

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...