dears,
I have a multisite cluster, how do I check if the network link between sites is not causing any to Splunk, and only have two indexers in each site? Is that recommended as there is a high utilization of CPU/memory?
Also, I would like to check this high utilization CPU/ memory from indexing or from search head activity. How would I do that?
The search head cluster that I installed in ES, I found that the skip ratio of Searches on captain is 100% all the time. Is that normal?
