Hi, I got data like this, which will show hop server between two destinations and certain metrics between them  source,final_destination,hop_number,hop_host,loss_perc 1.1.1.1,4.4.4.4,1,2.2.2.2,3 1.1.1.1,4.4.4.4,2,3.3.3.3,2 So I wanna show a visualization which shows like this 1.1.1.1. ( source ) ----- 3 ( loss perc ) -------> 2.2.2.2 ----2 ( loss perc ) ------> 3.3.3.3 -------> 4.4.4.4 ( final destination )  @niketn  ... View more

Hi SPlunkers, I have a multisite search head cluster TWO SH's SH1 ( SITE1 ) and SH2 ( SITE2 ) AND I have multisite indexer cluster - TWO IDX IDX1 ( SITE1) and IDX2 ( SITE2) So SH CLUSTER IS PAIRED WITH INDEXER CLUSTER VIA CLUSTER MASTER ---- This is the current setup Now I have a standalone Indexer which I want to add to this SH CLUSTER IS it possible? IF YES, could you please guide me !! ... View more

Hello everyone. I have a multisite Indexer cluster. 2 IDX (IDX01, IDX02) and CM 2 SH with a deployer and a VIP to SH cluster site 1 SH1 IDX01 CM site2 SH2 IDX02 search affinity is enabled. For example on SH1 if I run: |tstats c where splunk_server=IDX02 earliest=-24h by index I don't see any results. But I get results when I use splunk_server=IDX01 as both SH1 and IDX01 are on the same site = site1 Again on SH2 if I run: |tstats c where splunk_server=IDX01 earliest=-24h by index I don't see any results. But I get results when I use splunk_server=IDX02 as both SH2 and IDX02 are on the same site = site2 In the same way, on CM |tstats c where splunk_server=IDX02 earliest=-24h by index I don't see any results but I get results when I use splunk_server=IDX01 as both CM and IDX01 are in same site = site1. My Problem : IDX01 has High CPU usage alerts and has been almost hitting 100% for a long time. When I look in DMC under DMC Median CPU Usage by Process Class Maximum Search Concurrency Maximum Resource Usage of Searches it clearly shows that searches are hitting this IDX 01 then other IDX02. My doubts : 1. Is search affinity playing a role here? 2. If searches are more dispatching from SH1, is there a chance that more searches are running on IDX01 and causing high cpu problems? Please help me. Thank you! (edited) ... View more