Deployment Architecture

Can we still use Round-robin load balancing after version 4.2?

jingp66
New Member

Splunk experts:
I am looking at "Configure load balancing for horizontal scaling" in on-line document for 4.3.3(latest). There is a note as follow to confuse me.
"Note: Round-robin load balancing, which was previously available as an alternative to automatic load balancing, was deprecated in Splunk version 4.2. "

Can I still use "DNS list target" to configure the set of target receivers(multiple indexers) for horizontal scaling after version 4.2? is "Static list target" the best practice for load balancing after version 4.2? I am using 4.3 of splunk forwarder(splunkforwarder-4.3-115073.src.rpm) in RedHat 5/6.

Thanks

Ping

Tags (1)
0 Karma

bmacias84
Champion

@jingp66, Your current method of LB is valid for horizontal scaling. The note round-robin being depricated refers to spunks internal round-robin LB method not DNS round-robin.

Splunk's internal round-robin was based on load balancing by event. While auto-load balancing was based on time interval.

Pre 4.2 Load-balancing Doc:
round-robin load balancing: Forwarder routes data to different servers, switching with each new event, for example, event 1 goes to server A, event 2 to server B, event 3 to server C, and event 4 back to server A.

Current Doc:
Automatic load balancing: Forwarder routes data to different servers based on a specified time interval, for example, switching the data stream every 30 seconds, from server A to server B to server C and then back to server A.

If you are currently using Splunks LB round-robin method change change setting under your indexing group stanza to use the following.


[tcpout:Indexgroup1]
disabled=false
autoLBFrequency=40
server=splunkreceiver.mycompany.com:9997

Additional Docs:

Pre 4.2 LB doc

Current LB doc

Hope this helps.

0 Karma

jingp66
New Member

Thanks for your explanation, this is really help to clarify my question.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...