Search Affinity Disabled on multisite cluster : Search results are incomplete

[amey2407]

Hi,

We have a multisite cluster with 1 indexer on each site with 1 SH on primary site. Currently, when search affinity is enabled and we run a search for index "crowdstrike" , we can see past 30 days data. But when search affinity is disabled on the search head, the same search displays recent data and not the past 30 days.

Question: Is there something missing configuration wise?

[manikumarv]

Were you able to get this resolved?  We are experiencing the same when search affinity is disabled.

[amey2407]

@manikumarv Following were the steps followed by customer to resolve the issue. Hope this helps.

Apparently, the key steps are the ones highlighted below.

At the start of the MW, I've tried to add the search_factor=2 and restarted the CM for it to take effect, then to disable SA and restarted the SH.

Waited 10 mins or so but still the outcome was the same as before.

But I tried restarting the CM again, to ensure that all steps were followed to the key.

Almost immediately, the old events appeared.

Before

After

[manikumarv]

@amey2407 Thanks for the details.

We do have the [single-site] SF setting already on the CM as you noted.  But I did not try restarting CM after disabling SA on the SH.  I'll give that a try and let you know.