Deployment Architecture

indexers pool - two indexers, one fully loaded but the other empty


we have a s.o.s app to check the health of the indexer pool, i recently find out that one indexer is fully loaded on parsing, aggregation and queue for indexing but the other one is almost empty. it extremely not balance. Does anyone know how do I begin to troubleshoot that?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

I am assuming you are using Splunk forwarders with auto-load-balance to get data into your indexers.

This is a really good answer on this subject from @lguinn:

answers post

Describe your datasources, please If you have extremely busy ones, without any sort of "pause" i.e. syslog with very consistent stream of incoming data, the UF may never "switch" to another indexer using the auto-load-balancing feature. This is because the UF does not recognize event boundaries, so it waits for an EOF before it switches to another indexer. See here:

Auto-load balancing doc

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!