Hi @oliverja, As @sperkins points out, the search heads will periodically get the current generation (https://docs.splunk.com/Splexicon:Generation) from the indexer cluster master, this informs them where the primary copies are for each bucket which is the copies of the bucket they use when searching. "Even if a single indexer was the ingest point for all the data, it would still be scattered across the 10 indexers as it worked to meet the replication/search factors. There is no reason everything should be stuck on one site." I'm not sure this will be true, since if all the data is going to a single indexer the primary copies would initially be those buckets on that single indexer. Now, it is possible to re-balance the primary copies across indexers in the same site (this will happen when you restart indexers) but it doesn't appear possible to re-balance the primary copies across the whole cluster: https://docs.splunk.com/Documentation/Splunk/8.2.6/Indexer/Rebalancethecluster#Rebalance_indexer_cluster_primary_bucket_copies Given this, I'd say if you have disabled search affinity and want your search heads to search across all indexers you probably need to be sending an even amount of data for each indexer to both sites. Thanks, Jamie
... View more