Hello everyone.
I have a multisite Indexer cluster. 2 IDX (IDX01, IDX02) and CM
2 SH with a deployer and a VIP to SH cluster
site 1
SH1
IDX01
CM
site2
SH2
IDX02
search affinity is enabled.
For example on SH1 if I run:
|tstats c where splunk_server=IDX02 earliest=-24h by index
I don't see any results. But I get results when I use
splunk_server=IDX01
as both SH1 and IDX01 are on the same site = site1
Again on SH2 if I run:
|tstats c where splunk_server=IDX01 earliest=-24h by index
I don't see any results. But I get results when I use
splunk_server=IDX02
as both SH2 and IDX02 are on the same site = site2
In the same way, on CM
|tstats c where splunk_server=IDX02 earliest=-24h by index
I don't see any results but I get results when I use
splunk_server=IDX01
as both CM and IDX01 are in same site = site1.
My Problem :
IDX01 has High CPU usage alerts and has been almost hitting 100% for a long time.
When I look in DMC
under DMC
Median CPU Usage by Process Class
Maximum Search Concurrency
Maximum Resource Usage of Searches
it clearly shows that searches are hitting this IDX 01 then other IDX02.
My doubts :
1. Is search affinity playing a role here?
2. If searches are more dispatching from SH1, is there a chance that more searches are running on IDX01 and causing high cpu problems?
Please help me. Thank you! (edited)
↧