Hi,
I have set up a Splunk environment in which several applications will be sending data to a collection of indexers. I am considering using a traditional load balancer to manage the receiving of data by the indexers. Is this possible with a traditional load balancer or can I only do load balancing in Splunk via a Forwarder's load balancing capabilities?
Thanks in advance for your replies.
@Ant1D, The anwser is yes you can. To accomplish this you would use a modified version of Horizontal Scaling. Once you have configured you Traditional LB just configure your autoLBFrequency to the desireved value which will cause the forward to start a new stream on that interval.
Additional reading:
[tcpout]
defaultGroup=my_traditionalLB
[tcpout:my_traditionalLB]
disabled=false
autoLBFrequency=40
server=<IPorFQDN_of_LB>:9997
Hope this help or gets you started. Dont forget to vote or accept answers.
Cheers,
An example of a traditional load balancer here would be Cisco ACE
Hi I am basically saying that I do not want to use the load balancing functionality on Splunk Forwarders. I essentially want to know if someone has used an alternative to manage how data is sent to collection of forwarders
To better help you, could you please define what a "traditional load balancer" is? Then we should be able to help you out.