Uneven distribution of Logs in Multisite Cluster

[sarwshai]

Strange thing happened in my environment, we have got multisite cluster where all logs were distributed near perfectly.
There are 2 site, let's say site 1 and site 2. Now most of the Logs(90%) are getting transmitted only to site 2 and not site 1, we have similar pass4symkey on all indexers and forwarders, so issue due to this may be ruled out.
What may be the possible cause for this? Any solutions?

[tiagofbmm]

I'd start by checking which are the sourcetypes that are being badly distributed between the two sites. What about connectivity between the log sources and each of the sites?