We are planning to increasing Splunk indexers from 1 to 2. So, after this implementation, what are all the necessary changes we need to do at forwarder level.
Hi,
there are a couple of threads out there about this topic, even the splunk docs describe it here (forwarder load balancing) and here (indexer discovery).
You simply change your Universal/Heavy Forwarder's outputs.conf to one of those options.
Skalli