Deployment Architecture

Why is the search result still duplicate after the indexer cluster failure is repaired?

bestSplunker
Contributor

hey guys

I have a single site cluster contain 5 peer node 、4 search header 、1 cluster master 、1 deploye.

there are 3 peers and 1 sh were down for some reason at midnight,until this morning . peers and search restored are normal.all data is searchable、search factor is met and replication factor is met and remove all excess bukets.

before the cluster failure repair, the search results have no duplication events,
when the cluster failure occurs, the search results have a large number of errors and repeated events,
The phenomenon of duplicate events is still happening after the cluster failure repaired.

Why is the search result still duplicate after the indexer cluster failure is repaired? What should I do to working normally?

0 Karma

bestSplunker
Contributor

if I restart heavy forwarder, The phenomenon of duplication events will disappear? why?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...