Getting Data In

Is there a way to forward data collected using scripted inputs to multiple indexers using Splunk's load balancing feature?

sakti
Engager

Is there a way to forward data collected using [script] to multiple indexers using Splunk's load balancing feature? This is a TCP stream and am trying to implement this by using universal forwarder, and according to the documentation, it says:

Universal forwarders have a slight
disadvantage in that they can't switch
indexers when monitoring TCP network
streams of data unless they encounter
an End of File (EOF) marker in the
stream or an indexer goes down.

How and when could I introduce an EOF marker? Is there a setting in outputs.conf to do that or should my script handle this?

0 Karma

bernardoortega
Path Finder

Hello

You should use in outputs.,conf the following parameter:

forceTimebasedAutoLB=true

With this, it will load balance between indexers

regards

0 Karma

gjanders
SplunkTrust
SplunkTrust

I'm wondering if event breaker enable will help here https://docs.splunk.com/Documentation/Forwarder/6.5.0/Forwarder/Configureloadbalancing from the documentation I'm not clear if it will help here...

If not, you might want to consider a syslogNG instance or similar to receive the TCP logs and then read the files through the universal forwarder, I have a post on that here

0 Karma

sakti
Engager

Adding to the question, if I report the data every n seconds does that get counted as marking the data stream with EOF for every n seconds?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...