I currently only have a single splunk server, but i would like to break it out to a distributed setup. I have been wondering how to setup the network devices to forward syslog to a load balanced IP, so i dont lose any data during reboots etc. The easiest quickest way for me is windows network load balance. Does anyone else have experience with a setup like this?
is there a way to forward to 2 splunk servers and have it figure out that it's duplicate data and store only once?
How did you go with this?
I'm looking for documentation on the same thing.
no answers on this, i also have not had a chance to try it out yet.