Getting Data In

Load Balancing Universal Forwarders

jec013
Explorer

I am getting ready for a new install of Splunk. I am going to start with version 4.2. I would like to do a universal forwarder CLI install for the Windows servers we will be monitoring. We are going to be setting up load balancing for the indexers. Is there a way to specify multiple indexers during the CLI install? I have the following switch already configured:

RECEIVING_INDEXER="SplunkSvr01:9997"

Can I just add a comma and then SplunkSvr02:9997? I can't seem to find an answer anywhere in the documentation.

Thanks.

0 Karma
1 Solution

jec013
Explorer

I figured out a way to accomplish this. I created an outputs.conf file that I copied over the one installed in %SPLUNK_HOME\etc\system\local. The new outputs.conf file had both indexers defined and load-balancing set to true. I then stopped and started the SplunkForwarder service. I checked both index servers that I was using for load-balancing and they were both receiving data successfully.

View solution in original post

0 Karma

jec013
Explorer

I figured out a way to accomplish this. I created an outputs.conf file that I copied over the one installed in %SPLUNK_HOME\etc\system\local. The new outputs.conf file had both indexers defined and load-balancing set to true. I then stopped and started the SplunkForwarder service. I checked both index servers that I was using for load-balancing and they were both receiving data successfully.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Good question. In general, I prefer to install all forwarders as passive as possible, i.e, they do nothing and have no configuration except for the bare minimum necessary to update their own config from a centralized location, e.g. Splunk Deployment Server. That way, you don't have to worry about this and can easily update all your forwarders going forward.

This hasn't yet been updated for 4.2/Universal Forwarders (as for 2011-03-16), so the specific config file package is wrong, as are the MSI installer options, but the basic principle of sending out a passive forwarder with inputs disabled, no outputs, etc., is here:

http://www.splunk.com/wiki/Deploying_Splunk_Light_Forwarders

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...