Strange thing happened in my environment, we have got multisite cluster where all logs were distributed near perfectly.
There are 2 site, let's say site 1 and site 2. Now most of the Logs(90%) are getting transmitted only to site 2 and not site 1, we have similar pass4symkey on all indexers and forwarders, so issue due to this may be ruled out.
What may be the possible cause for this? Any solutions?
