Getting Data In

Scheduled scans are not load balancing across cluster and crashing the Indexer they get sent to.

Aixia
Engager

I have a cluster of 4 indexers.
The search head sends scheduled scans which always end up draining resources on one indexer out of the cluster and crashing it.

How can I get the searches distributed across the cluster?

0 Karma

yannK
Splunk Employee
Splunk Employee

If you have an indexer replication cluster, but see the search running only on the same indexers, then it can be that :

  • the ingestion of your data is not loadbalanced accross all indexers, so the same indexer always get the primary searchable buckets.
    check on the cluster-master with the SOS app on the replication dashboard, where your searchable buckets are.

  • Or maybe did you setup site replication, and because of the search affinity the search-head always search on the searchable buckets that are on the indexers on the same site. So maybe always the same.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Is it always the same Indexer? Is the Search head configured to search the Cluster and not the single indexer? If the only indexer going down is the same one every time there might be bigger issue.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!