Hi,
my setup consists of a dozen indexers and a few hundred forwarders.
If I look at the distributions of indexers the forwarders are connected to, I can see most indexers having about the same amount connections (+/-30%).
Except for our 2nd Indexer which holds about twice as many connections as the others.
The (light)-forwarders use auto-loadbalancing to distribute their data.
Versions in use: 5.04 Light Forwarders / 5.05 Indexer
What could be the problem? Thanks in advance
EDIT: Data is indexed only out of log-files. Looking at the switches of indexers there is a steady change every 30 seconds. The 2nd server just gets chosen more often.
EDIT2: We found a problem with streams not having an EOF, but the problem persists and even got clearer (because we sorted other misbehaviours out)