<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: outputs.conf in forwarder in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/outputs-conf-in-forwarder/m-p/52338#M10059</link>
    <description>&lt;P&gt;I'm not completely clear from the above what you are trying to accomplish.  You can set up a static list for auto load balancing.  Your forwarder will split up the data between the three indexers.  If one indexer is down it will just move on to the next one.  It's sending the same data to all indexers and therefore using up more data volume.&lt;/P&gt;

&lt;P&gt;[tcpout: BBB]&lt;BR /&gt;
server=10.10.10.1:9997,10.10.10.2:9997,10.10.10.3:9997&lt;/P&gt;</description>
    <pubDate>Tue, 15 May 2012 20:47:35 GMT</pubDate>
    <dc:creator>sdaniels</dc:creator>
    <dc:date>2012-05-15T20:47:35Z</dc:date>
    <item>
      <title>outputs.conf in forwarder</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/outputs-conf-in-forwarder/m-p/52337#M10058</link>
      <description>&lt;P&gt;If I've this in the outputs.conf in the fowarder:&lt;/P&gt;

&lt;P&gt;[tcpout]&lt;/P&gt;

&lt;P&gt;autoLB = true&lt;/P&gt;

&lt;P&gt;autoLBFrequency = 10&lt;/P&gt;

&lt;P&gt;compressed = false&lt;/P&gt;

&lt;P&gt;defaultGroup = BBB&lt;/P&gt;

&lt;P&gt;[tcpout:AAA]&lt;/P&gt;

&lt;P&gt;server = aaa.abc.com:9997&lt;/P&gt;

&lt;P&gt;[tcpout:BBB]&lt;/P&gt;

&lt;P&gt;server = bbb.abc.com:9997,bbb2.abc.com:9997&lt;/P&gt;

&lt;P&gt;[tcpout:CCC]&lt;/P&gt;

&lt;P&gt;server = ccc.abc.com:9997&lt;/P&gt;

&lt;P&gt;[tcpout-server://:9997]&lt;/P&gt;

&lt;P&gt;Would I be sending same data 3 times which BBB get load balancing?  Does that mean I'm burning 2 extra licenses?&lt;/P&gt;</description>
      <pubDate>Tue, 15 May 2012 20:39:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/outputs-conf-in-forwarder/m-p/52337#M10058</guid>
      <dc:creator>fuster_j</dc:creator>
      <dc:date>2012-05-15T20:39:39Z</dc:date>
    </item>
    <item>
      <title>Re: outputs.conf in forwarder</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/outputs-conf-in-forwarder/m-p/52338#M10059</link>
      <description>&lt;P&gt;I'm not completely clear from the above what you are trying to accomplish.  You can set up a static list for auto load balancing.  Your forwarder will split up the data between the three indexers.  If one indexer is down it will just move on to the next one.  It's sending the same data to all indexers and therefore using up more data volume.&lt;/P&gt;

&lt;P&gt;[tcpout: BBB]&lt;BR /&gt;
server=10.10.10.1:9997,10.10.10.2:9997,10.10.10.3:9997&lt;/P&gt;</description>
      <pubDate>Tue, 15 May 2012 20:47:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/outputs-conf-in-forwarder/m-p/52338#M10059</guid>
      <dc:creator>sdaniels</dc:creator>
      <dc:date>2012-05-15T20:47:35Z</dc:date>
    </item>
    <item>
      <title>Re: outputs.conf in forwarder</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/outputs-conf-in-forwarder/m-p/52339#M10060</link>
      <description>&lt;P&gt;Thank you for your input.  The config above was setup before my time, just want to verify it's cloning data 3 times and all the servers should be in load balance method.&lt;/P&gt;</description>
      <pubDate>Tue, 15 May 2012 21:07:59 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/outputs-conf-in-forwarder/m-p/52339#M10060</guid>
      <dc:creator>fuster_j</dc:creator>
      <dc:date>2012-05-15T21:07:59Z</dc:date>
    </item>
  </channel>
</rss>

