Hi, here in mine environmental i've more than 600 universal forwarders sending data to 2 heavy forwarder.
So try it this:
outputs.conf on heavy forwarder
[tcpout:LB_indexers]
autoLB=true
server=IP INDEXER A:5000,IP INDEXER B:5000
autoLBFrequency=7
[tcpout]
defaultGroup=LB_indexers
disabled=false
inputs.conf on heavy forwarder
[splunktcp://7700]
inputs.conf on indexer
[splunktcp://5000]
outputs.conf on universal forwarder
[tcpout:LB_forwarders]
autoLB=true
server=IP HEAVY FORWARDER A:7700,IP HEAVY FORWARDER A:7700
autoLBFrequency=7
[tcpout]
defaultGroup=LB_forwarders
disabled=false
AMARAL
... View more