Scenario-based Splunk Admin Use Case 4

10.07.24 07:45 PM - By Murugan

What happens, if all of the Indexers down in 3-member cluster?

    • The Complete data becomes inaccessible, Forwarders will hold the data, Search head will not show any data
    • The Cluster master will show all of the members' statuses as down.
    • This means the complete data is inaccessible, as all of the indexers are down.
    • The search head will not show any data for queries, as there are no indexers to take the request.
    • Forwarders will hold the data which can significantly increase the waiting queue on the forwarders.

Murugan