Hi @gcusello, I went through the documentation but could not find any example to route HTTP inputs. Will this still work if I plan to use "outputgroup=<string>" in inputs.conf of HEC?   //Yash   ... View more

Hi, I noticed that ingestion latency health check is turning yellow for indexers. Even there is a delay in searching for the data. The index queues shows blocked while checking the internal logs of heavy forwarders.  Could performing a rolling restart of indexers help since it has been a very long time now doing that.  ... View more

Thanks for pointing me out to a proper direction!   Here's our config from [clustering] stanza: [clustering] mode = master multisite = true available_sites = site1, site2 site_replication_factor = origin:1, site1:1, site2:1, total:3 site_search_factor = origin:1, site1:1, site2:1, total:2 cluster_label = cluster1 maintenance_mode = false max_peers_to_download_bundle = 10 service_interval = 10 heartbeat_timeout = 1800 cxn_timeout = 300 send_timeout = 300 rcv_timeout = 300 max_peer_build_load = 5 rolling_restart = searchable restart_timeout = 500 decommission_force_timeout = 900 restart_inactivity_timeout = 1500 rebalance_threshold = 0.96 max_auto_service_interval = 250   I suspect few things here like "rolling_restart" should be "searchble_force" and max_peers_to_download_bundle would be more than 10? considering we have 24 indexers.    I will go through all these parameters and understand it in detail. Do you suspect anything unusual in the configuration here? It would be much helpful! Thanks! ... View more