my indexers are sending way too much of data to my search heads (close to 500 GBs in a day) which is having an impact on the bandwidth utilisation.
Although from initial investigation it seemed like some of the dashboards were running long running searches which i had killed manually, but that just helped partially, is there any other aspects that i need to look into.
Indexers should only be sending interim search results to search heads. Do you have any indication of what is in those 500GB?
Long-running searches shouldn't be much of an issue. One should look for searches that return a lot of data by using non-streaming commands too soon. For instance, table in place of fields.
Thanks @richgalloway, i could not find any issues with any search in particular (yes there were users with badly written searches but that should not impact so much) as a test i disabled the realtime metadata search that populates the search summary page (disabled it globally so that no apps have that search running) and looks like it solved the issue.