@_pravin If i understood you correctly, you flip indexer receiving port whenever you have license overage and your SH becomes unresponsive. SH becomes unresponsive, because it keeps trying to comm...
See more...
@_pravin If i understood you correctly, you flip indexer receiving port whenever you have license overage and your SH becomes unresponsive. SH becomes unresponsive, because it keeps trying to communicate with those indexers, waiting for timeouts and retries. This causes high network activity, resource exhaustion, or unresponsive. If indexers are unresponsive, the SH waits for each connection to time out, which can block UI and search activity eventually. I would suggest not to use port flipping as a workaround. This destabilizes the cluster and SH. Instead, address license overages at the source (reduce ingestion, increase license, or use Splunk’s enforcement). Also for a quick workaround is to restart SH, which will clear the active connections. But the best approach is to address license issues at the source rather than blocking ingestion. Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!