Getting Data In

Uneven distribution of Logs in Multisite Cluster


Strange thing happened in my environment, we have got multisite cluster where all logs were distributed near perfectly.
There are 2 site, let's say site 1 and site 2. Now most of the Logs(90%) are getting transmitted only to site 2 and not site 1, we have similar pass4symkey on all indexers and forwarders, so issue due to this may be ruled out.
What may be the possible cause for this? Any solutions?

0 Karma


I'd start by checking which are the sourcetypes that are being badly distributed between the two sites. What about connectivity between the log sources and each of the sites?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!