Splunk Enterprise

put splunk heavy forwarders behind loadbalancer

raindrop18
Communicator

I have multiple heavy-forwarders and currently they are behind AWS route 53 DNS, and I am thinking if I get a benefit if I move the heavy forwarders behind loadbalancer. apperciate any feedback and if any related document about this highly appreciate it.

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Splunk doesn't recommend setting up external load balance between forwarder (universal fwd in your case, I assume) and receiver (Intermediate Heavy fwd in your case, I assume). (see note on paragraph 1)

https://docs.splunk.com/Documentation/Forwarder/7.0.1/Forwarder/Configureloadbalancing

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Splunk doesn't recommend setting up external load balance between forwarder (universal fwd in your case, I assume) and receiver (Intermediate Heavy fwd in your case, I assume). (see note on paragraph 1)

https://docs.splunk.com/Documentation/Forwarder/7.0.1/Forwarder/Configureloadbalancing

raindrop18
Communicator

thanks very help full information.

0 Karma

gwalford
Path Finder

Why do you feel you would get a benefit from a load balancer? By default, the forwarders switch indexers every 30 seconds. This happens when the forwarder detects and End of File.

Load Balancing like this is the key to making distributed search or clustering work.

http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setuploadbalancingd

Now, you do want to do this for search heads, and syslog-ng data, but that is a different topic.

raindrop18
Communicator

thanks for response. that answer my question!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...