Hi.
I'm working on splunk operations team.
version: Enterprise 7.3.4, centos7
Environment : 3 SH, 10 IDX cluster.
Search Factor : 3
Replication Factor : 3
Why is different tsidx file's size in same index?
My situation :
Tsidx file's size in one specific indexer is 2~3x larger than size in the rest indexer.
So, this indexer storage sometimes goes to above 97% and indexing stops. After splunk instance restart, for a few days storage remains at 86~87%. (the rest indexers always remain at 86%)
I checked rawdata file's size. But, size is only affected by event count.
Not all indexes are included. 10 of 100 indexes are included.
I can't find cause. Help me.
If you need additional information, please let me know.
Thank you.
