topic Re: SplunkForwarder Loadbalancing in Deployment Architecture

SplunkForwarder Loadbalancing

hojinpk — Thu, 08 Oct 2015 14:04:57 GMT

Hello,

I'd like to send syslog data to other syslog server via SplunkForwarder. So I configured in outputs.conf of the SplunkForwarder as below. However the packets are sending to 10.10.10.1 only. With this configuration, 10.10.10.2 server is not received syslog when syslog is sending to 10.10.10.1 server of course. But I can't see any incoming syslog on 10.10.10.2 even if I wait for a long time, about 1~2 hours.

[syslog:our_syslog]
disabled = false
autoLB = true
autoLBFrequency = 40
server = 10.10.10.1:514, 10.10.10.2:514
type = udp

P.S.) I confirmed that the UDP packet can be sent from SplunkForwarder server to 10.10.10.2 with Linux command: $ echo –n “hello” >/dev/udp/10.10.10.2/514

Could you give me any clue for resolve the issue?
Thank you in advance.

Re: SplunkForwarder Loadbalancing

asimagu — Thu, 08 Oct 2015 15:27:52 GMT

what steps did you follow? did you enable the forwarding app or did you change it under /system/local ? did you restart splunk after the config changes?

Re: SplunkForwarder Loadbalancing

hojinpk — Fri, 09 Oct 2015 07:50:50 GMT

First of all thank you for your reply.
-. I configured it on /opt/splunk/etc/system/local/inputs.conf
-. And then I restarted Splunk. /opt/splunk/bin/splunk restart

However, I didn't enable the forwarding app. I just set to Forwarder license group and I configured inputs.conf, props.conf, transforms.conf and outputs.conf to forward received data to the others. Could you let me know how can I enable the forwarding app?

Re: SplunkForwarder Loadbalancing

asimagu — Fri, 09 Oct 2015 13:57:12 GMT

ok, well, I take that you installed a full Splunk instance and that you want it to forward data with the SplunkForwader app. Therefore your instance will become a Heavyweight Forwarder (HWF)

Basically you need to enable the forwarding app and then configure outputs.conf and inputs.conf but inside the SplunkForwarder app: /opt/splunk/etc/apps/SplunkForwarder/local/

To enable the app:
splunk enable app SplunkForwarder -auth :

More info here: http://docs.splunk.com/Documentation/Splunk/6.3.0/Forwarding/Deployaheavyforwarder

If your instance was only a Universal Forwarder, then you can check out this doc
http://docs.splunk.com/Documentation/Splunk/6.3.0/Forwarding/Deployanixdfmanually