Deployment Architecture

Why is the search result still duplicate after the indexer cluster failure is repaired?

bestSplunker
Contributor

hey guys

I have a single site cluster contain 5 peer node 、4 search header 、1 cluster master 、1 deploye.

there are 3 peers and 1 sh were down for some reason at midnight,until this morning . peers and search restored are normal.all data is searchable、search factor is met and replication factor is met and remove all excess bukets.

before the cluster failure repair, the search results have no duplication events,
when the cluster failure occurs, the search results have a large number of errors and repeated events,
The phenomenon of duplicate events is still happening after the cluster failure repaired.

Why is the search result still duplicate after the indexer cluster failure is repaired? What should I do to working normally?

0 Karma

bestSplunker
Contributor

if I restart heavy forwarder, The phenomenon of duplication events will disappear? why?

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...