Uneven distribution of Logs in Multisite Cluster

sarwshai · ‎07-08-2019

Strange thing happened in my environment, we have got multisite cluster where all logs were distributed near perfectly.
There are 2 site, let's say site 1 and site 2. Now most of the Logs(90%) are getting transmitted only to site 2 and not site 1, we have similar pass4symkey on all indexers and forwarders, so issue due to this may be ruled out.
What may be the possible cause for this? Any solutions?

tiagofbmm · ‎07-09-2019

I'd start by checking which are the sourcetypes that are being badly distributed between the two sites. What about connectivity between the log sources and each of the sites?

Uneven distribution of Logs in Multisite Cluster

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Uneven distribution of Logs in Multisite Cluster

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future