How to configure a 4.1.2 forwarder to auto load balance across indexers

[msvoboda]

I'm trying to figure out how to configure the forwarders to auto load balance.

I saw this: http://www.splunk.com/base/Documentation/4.1.2/Admin/Outputsconf

#

----Automatic Load-balancing of forwarders

autoLB = true | false
* If set to true, forwarder switches to automatic load balancing mode. In this mode, the
* forwarder selects a new indexer every autoLBFrequency randomly. If connection to indexer
* is lost at any point, it selects a new live indexer and forwards data to it.
* If this flag is not present, forwarder uses load balancing with round robin strategy.
* Defaults to false.

autoLBFrequency = <seconds>
* This is used in automatic load balancing mode. Every autoLBFrequency a new indexer is
* selected randomly from list of indexers provided in server parameter
* Defaults to 30 seconds.

This is the only mention I can find about configuring / enabling auto load balancing on the forwarders. So, is the only config change needed to adjust outputs.conf and restart?

Thanks! Mike

[vrohit13]

This may be useful: http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Setuploadbalancingd

[gkanapathy]

Note that autoLB is different from "standard" load-balancing mode. Standard LB requires only that you list out multiple server/port targets in your server setting. However, it only works properly on non-Light Forwarders, and will usually give you badly broken events on a Light Forwarder. autoLB will work on all types of forwarder.

[Simeon]

Using the autoLB=true within the stanza for your forwarding group will enable autoLB. You are correct in assuming a restart is necessary to enable this functionality.