I have a cluster of 4 indexers.
The search head sends scheduled scans which always end up draining resources on one indexer out of the cluster and crashing it.
How can I get the searches distributed across the cluster?
If you have an indexer replication cluster, but see the search running only on the same indexers, then it can be that :
the ingestion of your data is not loadbalanced accross all indexers, so the same indexer always get the primary searchable buckets.
check on the cluster-master with the SOS app on the replication dashboard, where your searchable buckets are.
Or maybe did you setup site replication, and because of the search affinity the search-head always search on the searchable buckets that are on the indexers on the same site. So maybe always the same.
Is it always the same Indexer? Is the Search head configured to search the Cluster and not the single indexer? If the only indexer going down is the same one every time there might be bigger issue.
