We have intermediate forwarders that receive data from UFs and then forward it to our indexer cluster that consists of 4 indexers, my issue is I see imbalanced data distribution and resource usage,
for example currently I am looking at indexing rate
`indexer 1: 416K || CPU Usage 45%`
`indexer 2: 2.19M || CPU Usage 53%`
`indexer 3: 831K || CPU Usage 94%`
`indexer 4: 1.30M || CPU Usage 90%`
current output.conf
`[tcpout]`
`defaultGroup = indexer_cluster`
`forceTimebasedAutoLB = true`
`forwardedindex.2.whitelist = (_audit|_introspection|_internal)`
`[tcpout:indexer_cluster]`
`server = 0.0.0.46:0000, 0.0.0.47:0000, 0.0.0.48:0000, 0.0.0.76:0000`
where 0s represent indexer IPs and ports
↧