Data in SH

[gitingua]

Hello. I have 3 SH. When I switch the captain to another SH

Data disappears in it. In its normal state, SH has 20 million events. but when he becomes captain. It has a maximum of 400-500 events.  There is no such problem with the other two SH.

What is the problem ? please help me!!

[richgalloway]

Please tell us more about the problem.  How are you switching the SHC captain?  Why?  How are you looking for data (what is the query)?  Is it always the same instance that has the problem or any instance that happens to be captain?

BTW, normally search heads have no events in them.  All of their data comes from the indexers.

[gitingua]

@richgalloway 

I change either manually, or it changes automatically after the captain reboots. 

No request. when One host becomes the captain, the data stops flowing to him 

the data goes through the indexer, right. But only out of three SH, when he becomes the captain, he stops receiving data from the indexers.  In the normal state, SH receives data from the indexers completely, in total it has 20 million data, but when it becomes the captain, all data stops flowing to it and the total data becomes 400-500.

@richgalloway  Thank you !!

[richgalloway]

It's still not clear where you're getting this information.

Be aware that the SHC captain typically does not run any scheduled searches.  That will reduce the amount of traffic between the captain and the indexers.

[gitingua]

@richgalloway the captain is not getting the data. and I cannot search because of this. when I take it off the captain it works stably

[richgalloway]

"the captain is not getting the data."  You still haven't explained how you've determined this.  What query are you running to find out how much data each SH gets?  Are there any errors in splunkd.log or in the search log?