A safe first step is to verify that the group attribute in your IdP (such as AD/Okta/Azure AD) exactly matches what is configured in Splunk’s SAML group mapping. Small differences like case sensitivity or spacing can cause issues. You can also try the Reload SAML Configuration option, it simply refreshes the configuration and mappings without disrupting service, so it is generally safe to use when troubleshooting. ... View more

I’m thinking that this might be the same issue. ... View more

When the cluster meets the minimum threshold (e.g., 0.9 balance), the rebalance process considers its job “done,” even if distribution across the newest indexers still isn’t as even as expected. That’s why the first rebalance stopped after ~4 hours, while the second one restarted from ~20% and continued moving more buckets. Essentially, Splunk rebalancing is designed to gradually optimize data distribution while minimizing cluster load, not necessarily to perfectly even out every run. ... View more