Getting Data In

Is it possible to have multiple TCP output groups in outputs.conf and have events auto load balanced (autoLB) between them?

sunnybrarjpmc
New Member

Is it possible to have multiple tcp output groups in outputs.conf and have the events autoLB'd between them? My understanding is that autoLB only works within a given group and not multiple indexer groups.

0 Karma

woodcock
Esteemed Legend

You are correct; autoLB only happens within a group. Everything goes to each group and within each group there is load-balancing. There is no functional difference, though. Why would you desire to abstract a simple configuration that way?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Is it two different Splunk environments? Can you provide more information on what the reason for load balancing across two different groups would be?

0 Karma

sunnybrarjpmc
New Member

Yes, two different environments. We have an existing environment consisting of non-clustered indexers and a new group of clustered indexers that will be joining in. We'll be listing all clustered and non-clustered ones individually in outputs.conf but both sets use different certificates. We want the data to be spread (not duplicated) across both sets, and then we'll eventually stop the flow to the old ones.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...