I have two separate search heads, one for admins to use and another for regular users. The search head for admins once or twice a week will need to have splunk service restarted in order to read from the indexer again. Looking in the distributed search peers settings it shows the indexer as "Up", "Healthy" and with no failed health checks. When searching from this indexer on any index, no results are returned, almost as if it cannot talk to the indexer. Running a tcpdump on both the indexer and problematic search head shows bidirectional traffic between the two hosts with no issues.
Our other search head is still working fine and returning results so we know data is still being indexed properly. Is there anything specific I should be looking at to track down this issue?
↧