Hello All,    I currently have 6 indexers. Three of them are being forwarded data from outside sources. And the other three were added much later. I have a SF 1 and RF 1 (I understand this is not optimal, but due to space constraints that was the best I could do).  My main question is, why isn't a data rebalance rebalancing primary buckets? Even with a RF of 1, the three new indexers seem to only receive replicated buckets. Which is rather confusing.    I have tried using this: Rebalance the indexer cluster - Splunk Documentation curl -k -u admin:pass --request POST \ https://localhost:8089/services/cluster/manager/control/control/rebalance_primaries Nothing would occur after that.    ... View more