Getting Data In

Scheduled scans are not load balancing across cluster and crashing the Indexer they get sent to.


I have a cluster of 4 indexers.
The search head sends scheduled scans which always end up draining resources on one indexer out of the cluster and crashing it.

How can I get the searches distributed across the cluster?

0 Karma

Splunk Employee
Splunk Employee

If you have an indexer replication cluster, but see the search running only on the same indexers, then it can be that :

  • the ingestion of your data is not loadbalanced accross all indexers, so the same indexer always get the primary searchable buckets.
    check on the cluster-master with the SOS app on the replication dashboard, where your searchable buckets are.

  • Or maybe did you setup site replication, and because of the search affinity the search-head always search on the searchable buckets that are on the indexers on the same site. So maybe always the same.

0 Karma


Is it always the same Indexer? Is the Search head configured to search the Cluster and not the single indexer? If the only indexer going down is the same one every time there might be bigger issue.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!