Unequal number of Buckets in indexer clustering.

[motkarnaresh]

We have two indexers in our cluster and RF and SF are met. But the total number of buckets in one of the indexer is reducing day by day. present situation is, one indexer contain 25000 Buckets and other contain 5000 Buckets. Did anyone faced this type of situation? Please help me whether is this normal or need to worry?

[ddrillic]

It's interesting to see your view of the Indexer Clustering: Master Node

[horsefez]

Hi motkarnaresh,

looks wierd to me. I also administer a indexer cluster and I'm used to seeing diffences in bucket count aswell, but nothing that looks this extreme.

How much data are you indexing on average per day?
As TStrauch said, whats your RF?

What you could do for troubleshooting is following this documentation to list excess buckets.
https://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Removeextrabucketcopies

Don't remove them yet, just maybe show us the results of the splunk list excess-buckets command.

[motkarnaresh]

Hi Pyro_wood,

There is nothing in excess-buckets list. Our SF=2 and RF=2 and we have only two indexers.
Our Splunk version is 6.3.1

[TStrauch]

What is your search and replication faktor?

[motkarnaresh]

SF=2 and RF=2 and we have two indexers.