Splunk Search

How does Splunk reconstruct events when using forceTimebasedAutoLB?

the_wolverine
Champion

According to this blog post: http://blogs.splunk.com/2014/03/18/time-based-load-balancing/

Using this setting Splunk can break
the data stream and reconstruct the
event properly on the indexer.

That's pretty awesome. How exactly does this work when autoLB breaks the event and sends each segment to a different indexer? How do the indexers figure out where the other portion of the event is for reconstruction?

diogofgm
SplunkTrust
SplunkTrust

The forwarder sends 64KB chunks of data to the indexer (no matter the events on it). When its forced to send data to a second indexer, it resends the last 64KB chunk again to the second indexer. So:
1 - The first indexer it will index everything before the last event break and ignore the rest (to avoid indexing an incomplete event).
2 - The second indexer will index the data after the last event break which will be complete by the following 64KB chunks data.

This works ok if the events are smaller that 64KB.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

the_wolverine
Champion

We're seeing broken events so I'm not sure if it's working as expected.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

whats the size of your events? can you post a sample?

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

dflodstrom
Builder

I'm also interested in the behavior of this setting. Any update for us?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...