Why do my indexers in my indexer clustering environment have a different number of buckets?

[daniel_augustyn]

I just deployed Splunk in an indexer cluster deployment, and I've noticed that my indexers have a different number of buckets. Shouldn't they have the same number of buckets since the data is replicated? Or not all buckets get replicated between indexers?

[Yasaswy · Accepted solution]

Hi,
Buckets are not just limited to replication activity, they also include data being received. Depending on your deployment and how your forwarders are configured it's possible that some of your systems are forwarding to only few of the indexers in your cluster causing them to have higher bucket counts. Eg: if you have a cluster of 8 indexers with a replication factor of 2, but some of the forwarders in your environment are only set to forward to 3 of these, you will naturally see more buckets on these irrespective of your replication activities.
Similarly it's also possible that firewalls might be blocking the forwarder access to some of your indexers (again depends on your env) causing the same issue. If you have set up custom load balancing on your forwarders, it can also cause this... there might be other similar reasons.. but you get the idea.

[daniel_augustyn]

Thanks --