We have a set-up where all of the forwarders send data to indexer A and indexer A forwards this on to indexer B, hence giving us a high (data query) availability solution.
What confuses me is that the indexed data on indexer B is double that on A... This doesn't seem to make sense to me, it should be identical?
Indexer B is also above the HA license quota, yet never violates. Obviously this is something to do with the HA license, but since I don't understand the mechanics of this thoroughly I'm not sure exactly why it doesn't violate.
Please could someone shed some light?!
What confuses me is that the indexed data on indexer B is double that on A
Perhaps as well as Indexer A cloning on to Indexer B your forwarders are also cloning to Indexer B ?? Just taking a guess in the dark, but something to check for anyway.