Splunk Enterprise Security: Why are search results based on Data Models different across all search heads in our multisite search head cluster?

[support0]

Hello,

On a search head cluster of 3 members with Splunk Enterprise Security, search results match exactly with all Search Heads.

But results based on Data Model are different across all Search heads.
Search affinity is disabled with site = site0.

I don't understand why we have this behavior.

Thanks for your help.

Regards

[support0 · Accepted solution]

I think have found the issue, i mean the mistake, search use for "incident reviews" dashboard uses macro named "notable" which use index "notable" and local SH datas are not forwarded to indexers at this time.

[jkat54]

You should provide us with an example of a search using your datamodel that doesnt give the anticipated results and then tell us what results you're expecting but not seeing.

Also, we need to understand your indexer configuration(s). Do you have just one indexer? 20 indexers, 5 in Atlanta 15 in new york?

My first guess is that your limits.conf is different on your indexers/peers.

[support0]

Hello,

Thanks for your answer, after investigation it's seem that just this view (incident review) is affected, if i compare data model results they match.

Two sites are in the same region, with high speed network, 5 indexers / 2 SH on each site.

I will check limits parameters with btool but files must be similar, because pushed with deployer.

Maybe it's a caching problem, Splunk side or browser side, i will check that too.

Regards,