Deployment Architecture

Why is the search result still duplicate after the indexer cluster failure is repaired?

bestSplunker
Contributor

hey guys

I have a single site cluster contain 5 peer node 、4 search header 、1 cluster master 、1 deploye.

there are 3 peers and 1 sh were down for some reason at midnight,until this morning . peers and search restored are normal.all data is searchable、search factor is met and replication factor is met and remove all excess bukets.

before the cluster failure repair, the search results have no duplication events,
when the cluster failure occurs, the search results have a large number of errors and repeated events,
The phenomenon of duplicate events is still happening after the cluster failure repaired.

Why is the search result still duplicate after the indexer cluster failure is repaired? What should I do to working normally?

0 Karma

bestSplunker
Contributor

if I restart heavy forwarder, The phenomenon of duplication events will disappear? why?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!