Deployment Architecture

Can we still use Round-robin load balancing after version 4.2?

jingp66
New Member

Splunk experts:
I am looking at "Configure load balancing for horizontal scaling" in on-line document for 4.3.3(latest). There is a note as follow to confuse me.
"Note: Round-robin load balancing, which was previously available as an alternative to automatic load balancing, was deprecated in Splunk version 4.2. "

Can I still use "DNS list target" to configure the set of target receivers(multiple indexers) for horizontal scaling after version 4.2? is "Static list target" the best practice for load balancing after version 4.2? I am using 4.3 of splunk forwarder(splunkforwarder-4.3-115073.src.rpm) in RedHat 5/6.

Thanks

Ping

Tags (1)
0 Karma

bmacias84
Champion

@jingp66, Your current method of LB is valid for horizontal scaling. The note round-robin being depricated refers to spunks internal round-robin LB method not DNS round-robin.

Splunk's internal round-robin was based on load balancing by event. While auto-load balancing was based on time interval.

Pre 4.2 Load-balancing Doc:
round-robin load balancing: Forwarder routes data to different servers, switching with each new event, for example, event 1 goes to server A, event 2 to server B, event 3 to server C, and event 4 back to server A.

Current Doc:
Automatic load balancing: Forwarder routes data to different servers based on a specified time interval, for example, switching the data stream every 30 seconds, from server A to server B to server C and then back to server A.

If you are currently using Splunks LB round-robin method change change setting under your indexing group stanza to use the following.


[tcpout:Indexgroup1]
disabled=false
autoLBFrequency=40
server=splunkreceiver.mycompany.com:9997

Additional Docs:

Pre 4.2 LB doc

Current LB doc

Hope this helps.

0 Karma

jingp66
New Member

Thanks for your explanation, this is really help to clarify my question.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...