Deployment Architecture

Auto Load Balancing Configuration Help...

balbano
Contributor

Hi guys,

For some reason looks like the Auto Load Balancing Config for my Light Forwarders is actually creating a copy of the same log on each indexer (2 indexers). I had assumed that autoLB would rotate logging from one server to the other every 30 seconds. Did I mis-configure my outputs.conf file somehow? Here is my outputs.conf file below:

outputs.conf file


[tcpout]
defaultGroup = indexer1, indexer2
disabled = false

[tcpout:indexer1]
server = $indexer1_IP:9996
compressed = true

[tcpout:indexer2]
server = $indexer2_IP:9996
compressed = true

[tcpout-server://$indexer1_IP:9996]
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = ******
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false

[tcpout-server://$indexer2_IP:9996]
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = ******
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false

[tcpout:my_LB_indexers]
autoLB=true
server=$indexer1_IP:9996,$indexer2_IP:9996
compressed = true

[tcpout]
maxQueueSize = 1000


Any help you can provide would be great.

Thanks.

Brian

1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

It looks like this:

[tcpout]
defaultGroup = indexer1, indexer2

Should read:

[tcpout]
defaultGroup = my_LB_indexers

And you might remove this:

[tcpout:indexer1]
server = $indexer1_IP:9996
compressed = true

[tcpout:indexer2]
server = $indexer2_IP:9996
compressed = true

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

It looks like this:

[tcpout]
defaultGroup = indexer1, indexer2

Should read:

[tcpout]
defaultGroup = my_LB_indexers

And you might remove this:

[tcpout:indexer1]
server = $indexer1_IP:9996
compressed = true

[tcpout:indexer2]
server = $indexer2_IP:9996
compressed = true
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...