Why is one indexer consuming much more physical disk space than the other indexers?

[venkatesh296]

Hi Everyone,
In our environment we have two indexers, each one has 500 gb disk usage, but one indexer used almost 90% of disk usage other indexer used only 30%. Can anyone help regarding this?

Thanks.

[ddrillic]

As a sanity check, can you please go to the License Usage Reporting panel in the License Master and run the Previous 30 days report, with Pool as All Pools and Split by as Indexer?

[MuS]

Hi venkatesh296,

since you are not mentioning any replication in your question, I would suggest to check

• indexes.conf on both servers if they are the same
• check the outputs.conf used by any sending forwarder if they are using both indexers or just one
• check out this answer about the so called server affinity https://answers.splunk.com/answers/168363/distributed-setup-question.html and maybe change the setting to forceTimebasedAutoLB = true in outputs.conf

Hope this helps to get you started ...

cheers, MuS

[nabeel652]

Is it the indexes that make the difference. Check your "Path to indexes" and is the size of the disk/folder of splunkdb on both indexers is the same? If yes, your indexes are being replicated properly but there is some other problem on one of your indexers.